Debian Bro install

Zeek
1

I have been trying to get bro to configure {./configure} for some time now, and get errors at the end of the script run. Something to the tune of libpcap errors. Is there a package or packages I need to install to get bro to compile properly?

TIA
David Caldwell

2

Have you tried...
   ./configure --enable-shippedpcap

   .Seth

3

David Caldwell wrote:

I have been trying to get bro to configure {./configure} for some
time now, and get errors at the end of the script run. Something to
the tune of libpcap errors. Is there a package or packages I need to
install to get bro to compile properly?

you should have libpcap installed. usually an 'apt-get install libpcap'
will work.

If you want to send the output of your configure, I might be able to
see what the problem is.

Cheers,
jason

4

You'll need to install libpcap. See this page of the manual for more info:

http://www.bro-ids.org/Bro-user-manual/Hardware-and-Software-Requirements.html

David Caldwell wrote:

5

Hello David,

I installed and ran the last Bro's version on both Sarge and Etch without
problems.

Could you send the relevant informations (details of the log) please ?

Best regards.

6

Hello,

I just checked my own debian and here are the results.

1) a "./configure" on the archive (i only "grep"ed the pcap ref)

checking for pcap_open_live in -lpcap... yes
checking for pcap_freecode in -lpcap... yes
checking for pcap headers... /usr/include
checking if pcap_compile_nopcap needs error parameter... not needed
checking pcap-int.h usability... no
checking pcap-int.h presence... no
checking for pcap-int.h... no
checking for bpf_set_bufsize... no
checking for pcap_version in libpcap... yes
checking for main in -lpcap... yes

2) a "dpkg -l | grep pcap" on the debian

ii libpcap0.8 0.9.5-1 System interface for user-level packet captu
ii libpcap0.8-dev 0.9.5-1 Development library and header files for lib

I suggest you verify about these two packages.

Best regards.

7

apt-get install libpcap-dev

optionally you could install libmagic-dev and libclamav-dev.

8

I thought I had responded to the list with this one. Yes, I have. I have also installed other packages that were suggested to make it work, but unfortunately that hasn't helped either.

The thing is everything seems to work fine till it gets close to conclusion. The final messages I get are:

checking for tgetnum in -ltermcap........no
checking for termcap in /usr/lib{64}/termcap/......no
configure: error: libtermcap not found in default paths nor /usr/lib{64}/termcap
.

I get that same error even using the --enable-shippedpcap option. I am not sure what I am doing wrong, but something is amiss here.

I will try to send my responses directly back to the group from here on out.

Thanks for the response

David Caldwell

9

Hi David,

I thought I had responded to the list with this one. Yes, I have. I
have also installed other packages that were suggested to make it
work, but unfortunately that hasn't helped either.

The thing is everything seems to work fine till it gets close to
conclusion. The final messages I get are:

checking for tgetnum in -ltermcap........no
checking for termcap in /usr/lib{64}/termcap/......no
configure: error: libtermcap not found in default paths nor /usr/lib
{64}/termcap
.

I get that same error even using the --enable-shippedpcap option. I
am not sure what I am doing wrong, but something is amiss here.

yeah, and it's unlikely to have anything to do with libpcap! As the
output says, it's not finding libtermcap. Do you have libtermcap on your
system? It is currently required for the build. On my Fedora system, for
example, I have

$ rpm -ql libtermcap libtermcap-devel
/lib/libtermcap.so.2
/lib/libtermcap.so.2.0.8
/usr/include/termcap.h
/usr/lib/libtermcap.a
/usr/lib/libtermcap.so
/usr/share/info/termcap.info.gz

If it's installed but ends up in an unusual location on Debian, please
let us know, otherwise try installing libtermcap and libtermcap-devel
and see if that fixes things...

Cheers,
Christian.

10

Ahhh,

  Its not a libpcap problem but a termcap problem. On debian try:

   apt-get install libncurses5-dev

Cheers,
jason

David Caldwell wrote:

11

That got it!!! I had no idea that ncurses was not installed as part of the base install for Debian. I am now looking at the config screen, and I do very much appreciate everyones assistance. Now to start making things happen!!!

David