Kubuntu 11.04 Install DAQ-0.5 with NFQ

To install Snort 2.9.0.5, you are now required to install the new DAQ or data-acquisition API dependency. To get it to be built and compiled you need to do the following:

Install necessary packages:

sudo aptget install g++ flex bison  build-essential checkinstall libnet1-dev  libpcre3-dev libnetfilter-queue-dev iptables-dev

Install libpcap 1.1.1

  1. wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
  2. tar -xzvf libpcap-1.1.1.tar.gz
  3. cd libpcap-1.1.1
  4. sudo ./configure
  5. sudo make
  6. sudo make install
  7. sudo ldconfig

Install libdnet

  1. wget http://libdnet.googlecode.com/files/libdnet-1.12.tgz
  2. tar xvfz libdnet-1.12.tgz
  3. cd libdnet-1.12/
  4. sudo ./configure --enable-static --with-pic
  5. sudo make
  6. sudo make install
  7. sudo ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1
  8. sudo ldconfig

Install DAQ

  1. http://www.snort.org/downloads/860
  2. tar -xzvf 860
  3. cd daq-0.5/
  4. sudo ./configure --libdir=/usr/lib --includedir=/usr/include
  5. sudo make
  6. sudo make install
  7. sudo ldconfig

If you had no compilation errors, you should see something like the following:

  1. Build AFPacket DAQ module.. : yes
  2. Build Dump DAQ module...... : yes
  3. Build IPFW DAQ module...... : yes
  4. Build IPQ DAQ module....... : yes
  5. Build NFQ DAQ module....... : yes
  6. Build PCAP DAQ module...... : yes

Blog tags: 

Comments

wrong command

hi,
in the Step : "Install libpcap 1.1.1"
please correct the command number 6
"sudo make install instead" of "sudo install"

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.