Snort compilation errors - error while loading shared libraries: libdnet.1: and libsfbpf.so.0 error

While compiling snort source, you will often encounter the following errors:

 error while loading shared libraries: libdnet.1:

Do this to get rid of the error:


#cp /usr/local/lib/libdnet.1.0.1 /usr/local/lib/libdnet.so.1.0.1
#/sbin/ldconfig

If this does not help, try this:
#ln -sf /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1
#/sbin/ldconfig

If that still does not help,
#LD_LIBRARY_PATH=/usr/local/lib
#export LD_LIBRARY_PATH

Another error that is encountered is:

error while loading shared libraries:
libsfbpf.so.0: cannot open shared object file: No such file or directory

To get rid of this error, do:
#/sbin/ldconfig

If this does not help, add '/usr/local/lib' to '/etc/ld.so.conf'

Finally, test the snort instance:
#snort -c /etc/snort.conf -T

These solutions have been tested on CentOS/SL variants and they work well.

Reference links:
http://seclists.org/snort/2014/q1/221

Getting more information about Snort rules

Periodically, I often require more information about the snort IDS alert that was triggered by looking in the logs. I find it tedious to look into the snort manual and find more details about the alert. Fortunately, SourceFire (now Cisco!) the company behind Snort, has provided online option.

In every snort alert, there is a section that reads something like [3:15912:2]. This breaks down as the [(detection mechanism):(signature ID):(signature revision)]. Using the SID (the middle number) you can find more information about most signatures.

If the number is less than 1000000, it is a SourceFire rule. In this case you can get more information about the rule by going to https://www.snort.org/search?query=15912&submit_search=

If the number is between 1000000 and 2000000, it is a snort community rule. In this case, the best source of information will be the rule itself which can be downloaded from Community Rules.

If the number is between 2000000 and 3000000 it comes from emergingthreats.net and you can get more information by going to http://doc.emergingthreats.net/bin/view/Main/<sid number> .

Finally, if the number is in the 6000000 to 7000000 range it is a custom rule that is developed based upon patterns.