Quantcast
Channel: Active questions tagged ubuntu - Stack Overflow
Viewing all articles
Browse latest Browse all 5995

Snort 3.0 Error: Could not find requested DAQ moduel: pcap

$
0
0

I am trying to install Snort 3.0 on an Ubuntu 20.04 desktop. I'm using the manual as a guide for this install. Everything went well and it seems the install went fine, however, at page 6, to test Snort with the default configuration file it wants me to pass snort -c /usr/local/etc/snort/snort.lua but I am getting the error Error: Could not find requested DAQ moduel: pcap I've spent a few hours yesterday Googling but could not find anything. Now, I am a complete beginner when it comes to Ubuntu. What repository do I need to install to get this going? Thanks!

UPDATESo I installed pcap from the tcpdump, but that did not resolve it. I am still getting the same error.

http://www.tcpdump.org/release/libpcap-1.10.0.tar.gz

I passed:

wget http://www.tcpdump.org/release/libpcap-1.10.0.tar.gztar -xzvf libpcap-1.10.0.tar.gz

Install went fine.

Then I passed:

    /usr/local/bin/snort -V       ,,_     -*> Snort++<*-  o"  )~   Version 3.1.0.0''''    By Martin Roesch & The Snort Team               http://snort.org/contact#team               Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.               Copyright (C) 1998-2013 Sourcefire, Inc., et al.               Using DAQ version 3.0.0               Using LuaJIT version 2.1.0-beta3               Using OpenSSL 1.1.1f  31 Mar 2020               Using libpcap version 1.9.1 (with TPACKET_V3)               Using PCRE version 8.44 2020-02-12               Using ZLIB version 1.2.11               Using FlatBuffers 1.12.0               Using Hyperscan version 5.3.0 2021-02-01               Using LZMA version 5.2.4

Then I passed:

administrator@Ubuntu:~/snort_src$ snort -c /usr/local/etc/snort/snort.lua--------------------------------------------------o")~   Snort++ 3.1.0.0--------------------------------------------------Loading /usr/local/etc/snort/snort.lua:Loading snort_defaults.lua:Finished snort_defaults.lua:Loading file_magic.lua:Finished file_magic.lua:    ssh    hosts    host_cache    pop    so_proxy    stream_tcp    smtp    gtp_inspect    packets    dce_http_proxy    stream_icmp    normalizer    alerts    rewrite    ips    stream_udp    binder    wizard    appid    search_engine    file_id    ftp_data    ftp_server    port_scan    dce_http_server    dce_smb    dce_tcp    telnet    ssl    sip    rpc_decode    netflow    http_inspect    network    http2_inspect    modbus    host_tracker    stream_user    stream_ip    trace    back_orifice    classifications    dnp3    active    ftp_client    decode    daq    stream    references    arp_spoof    output    process    dns    dce_udp    imap    stream_fileFinished /usr/local/etc/snort/snort.lua:--------------------------------------------------ERROR: Could not find requested DAQ module: pcapFATAL: see prior 1 errors (0 warnings)Fatal Error, Quitting..

Please advise. Thank you.

UPDATE

It looks like I already have the latest pcap version.

dministrator@Ubuntu:~/snort_src$ sudo apt-get install -y libpcap-devReading package lists... DoneBuilding dependency tree       Reading state information... Donelibpcap-dev is already the newest version (1.9.1-3).The following packages were automatically installed and are no longer required:  libfprint-2-tod1 libllvm10Use 'sudo apt autoremove' to remove them.0 upgraded, 0 newly installed, 0 to remove and 6 not upgraded.

Ran dir and it looks like I got everything installed?

administrator@Ubuntu:~/snort_src$ dirboost_1_74_0            libpcap-1.10.0.tar.gzboost_1_74_0.tar.gz     libsafec-02092020.0-g6d921fflatbuffers-1.12.0      libsafec-02092020.tar.gzflatbuffers-build       LuaJIT-2.1.0-beta3flatbuffers-v1.12.0.tar.gz  LuaJIT-2.1.0-beta3.tar.gzgperftools-2.8          pcre-8.44gperftools-2.8.tar.gz       pcre-8.44.tar.gzhyperscan-5.3.0         ragel-6.10hyperscan-5.3.0-build       ragel-6.10.tar.gzlibdaq-3.0.0            snort3-3.1.0.0libdaq-3.0.0.tar.gz     snort3-3.1.0.0.tar.gzlibpcap-1.10.0          v5.3.0.tar.gz

I'm out of ideas...Thank you.


Viewing all articles
Browse latest Browse all 5995

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>