barnyard2 Will not compile with libpcap.1.9.0

I am unable to make barnyard2-master with the latest libpcap.1.9.0. Works fine with libpcap.1.8.1. Below is the error I receive:

make all-recursive make[1]: Entering directory /home/analyst/installation_files/barnyard2-master' Making all in src make[2]: Entering directory /home/analyst/installation_files/barnyard2-master/src' Making all in sfutil make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/sfutil' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c getopt_long.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfmemcap.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfprimetable.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfxhash.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ip.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_iph.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ipvar.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_textlog.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_vartable.c rm -f libsfutil.a ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o ranlib libsfutil.a make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/sfutil' Making all in output-plugins make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/output-plugins' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_bro.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_cef.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_csv.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fast.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_full.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/output-plugins' make[2]: Leaving directory /home/analyst/installation_files/barnyard2-master/src' make[1]: Leaving directory /home/analyst/installation_files/barnyard2-master' In file included from ../decode.h:49:0, from ../plugbase.h:70, from ../spooler.h:32, from ../barnyard2.h:52, from spo_alert_fwsam.c:91: /opt/snort/include/sfbpf_dlt.h:642:0: warning: "DLT_IEEE802_15_4" redefined [enabled by default] #define DLT_IEEE802_15_4 195 ^ In file included from /opt/snort/include/pcap/bpf.h:109:0, from /opt/snort/include/pcap/pcap.h:88, from /opt/snort/include/pcap.h:43, from ../barnyard2.h:46, from spo_alert_fwsam.c:91: /opt/snort/include/pcap/dlt.h:749:0: note: this is the location of the previous definition #define DLT_IEEE802_15_4 DLT_IEEE802_15_4_WITHFCS ^ In file included from /opt/snort/include/pcap.h:43:0, from ../barnyard2.h:46, from spo_alert_fwsam.c:91: /opt/snort/include/pcap/pcap.h:950:18: error: two or more data types in declaration specifiers #define SOCKET int ^ spo_alert_fwsam.c:118:13: note: in expansion of macro ‘SOCKET’ typedef int SOCKET; ^ spo_alert_fwsam.c:118:1: warning: useless type name in empty declaration [enabled by default] typedef int SOCKET; ^ spo_alert_fwsam.c: In function ‘AlertFWsam’: spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable] ClassType *cn = NULL; ^ spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable] static unsigned short lastbsp[FWSAM_REPET_BLOCKS]; ^ make[3]: *** [spo_alert_fwsam.o] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

Jan 20 '19 16:01 csbflyer

This occurs when trying to compile with libpcap.1.9.0 snort, libpcap and daq all exist in /opt/snort.

Jan 25 '19 22:01 csbflyer

Well, it seems this project is pretty abandoned, isn't?

Mar 05 '19 10:03 q2dg

I have the same problem as you，Have you solved it?

May 13 '19 04:05 YBSNNLRX

I switched to previous version of libpcap, however, you can compile barnyard2 in separate directory from snort with libpcap 1.9.0. /opt/snort /opt/barnyard2

May 13 '19 22:05 csbflyer

I switched to libpcap-1.8.1 or libpcap-1.5.3，then compile barnyard2 also display below error : make all-recursive make[1]: Entering directory /etc/snort/barnyard2' Making all in src make[2]: Entering directory /etc/snort/barnyard2/src' Making all in sfutil make[3]: Entering directory /etc/snort/barnyard2/src/sfutil' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c getopt_long.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfmemcap.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfprimetable.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfxhash.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ip.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_iph.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ipvar.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_textlog.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_vartable.c rm -f libsfutil.a ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o ranlib libsfutil.a make[3]: Leaving directory /etc/snort/barnyard2/src/sfutil' Making all in output-plugins make[3]: Entering directory /etc/snort/barnyard2/src/output-plugins' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_bro.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_cef.c spo_alert_cef.c: In function ‘AlertCEF’: spo_alert_cef.c:500:15: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable] ClassType *cn; ^ gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_csv.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fast.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_full.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c spo_alert_fwsam.c: In function ‘AlertFWsam’: spo_alert_fwsam.c:966:5: error: unknown type name ‘SOCKET’ SOCKET stationsocket; ^ spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable] ClassType *cn = NULL; ^ spo_alert_fwsam.c:980:18: warning: variable ‘sn’ set but not used [-Wunused-but-set-variable] SigNode *sn = NULL; ^ spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable] static unsigned short lastbsp[FWSAM_REPET_BLOCKS]; ^ spo_alert_fwsam.c: In function ‘FWsamCheckOut’: spo_alert_fwsam.c:1392:5: error: unknown type name ‘SOCKET’ SOCKET stationsocket; ^ spo_alert_fwsam.c: In function ‘FWsamCheckIn’: spo_alert_fwsam.c:1543:5: error: unknown type name ‘SOCKET’ SOCKET stationsocket; ^ make[3]: *** [spo_alert_fwsam.o] Error 1 make[3]: Leaving directory /etc/snort/barnyard2/src/output-plugins' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory /etc/snort/barnyard2/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory /etc/snort/barnyard2' make: *** [all] Error 2

May 14 '19 02:05 YBSNNLRX

This worked for me: Make snort & libpcap 1.9 in /opt/snort Make barnyard2 in /opt/barnyard2

May 14 '19 21:05 csbflyer

So as long as snort and barnyard2 are in separate directories, it's possible to build them both with libpcap 1.9. Am I understanding that correctly?

May 15 '19 00:05 NathanGibbs3

Actually snort and barnyard2 is in separate directories, but this error is along exist,I haven't found a solution yet. Do you think it necessary for me to reinstall it?

May 15 '19 06:05 YBSNNLRX

Hi you can compile with libpcap-1.8.1

Aug 18 '19 08:08 miladstar77

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

Aug 20 '19 05:08 YBSNNLRX

My pull request here fixes this particular issue: https://github.com/firnsy/barnyard2/pull/254

Dec 13 '19 23:12 Gerjo

My pull request here fixes this particular issue: #254

I am grateful for this great service! Thank you so very much.

Apr 08 '20 15:04 ParagVadher

My pull request here fixes this particular issue: #254

Works fine. Thank you. Why isn't this merged yet?

Apr 18 '20 23:04 FalcoGer

@Gerjo Thank you for the fix! I applied this fix, too: https://github.com/firnsy/barnyard2/issues/252 and things are moving along now.

Oct 20 '20 03:10 519seven

Hi It's compatible with libpcap 1.8.1

On Wed, Nov 11, 2020, 03:15 Mehrshad [email protected] wrote:

Hi you can compile with libpcap-1.8.1

How ?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/firnsy/barnyard2/issues/245#issuecomment-725035128, or unsubscribe https://github.com/notifications/unsubscribe-auth/AMFN7SPWZYSFAIPX33XGU33SPHGAHANCNFSM4GRG4IFQ .

Nov 11 '20 04:11 miladstar77

I'm sorry for my poor English.

My environment is Ubuntu 20.04 LTS.

I have some questions.

I use "apt" command to manage package.

(1) Which libpcap means "libpcap-dev" or "libpcap0.8" ?

(2) What should I do to uninstall libpcap 1.9.1 and install libpcap 1.8.1 ?

(3) I unistalled libpcap-dev 1.9.1 and installed libpcap-dev 1.8.1.

Then, when I executed "snort -V", result includes a sentence of "Using libpcap version 1.9.1".

What should I do to make this sentence "Using libpcap version 1.8.1"?

I'm sorry for many questions.

Nov 25 '21 14:11 Atsuyakitamago

What you did in (3) should allow you to build barnyard2. It does not matter which libpcap snort is using.

Nov 30 '21 15:11 NathanGibbs3

Sorry for the late reply. It worked. Thank you very much!

May 12 '22 06:05 Atsuyakitamago

Hi to all! I have a problem! I'm trying to build barnyard2 on ubuntu 22.04. But some errors arise. As i saw from previous comments it happens because of libpcap 1.9.1. If its true, please provide me with strict commands for reinstalling libpcap to 1.8.1 version! Thank you!

Nov 15 '23 21:11 Camanche827

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

Hello! Do you still remember how you reinstall libpcap?

Nov 15 '23 21:11 Camanche827

barnyard2 barnyard2 copied to clipboard

Will not compile with libpcap.1.9.0

barnyard2
barnyard2 copied to clipboard