Snort: 2.9.2.3 pkg v. 2.2.1 /usr/local/lib/libdnet.1: unsupported file layout

taryezveb

2.0.1-RELEASE (amd64)
built on Mon Dec 12 18:43:51 EST 2011
FreeBSD 8.1-RELEASE-p6

Snort: 2.9.2.3 pkg v. 2.2.1

I keep getting the following error when trying to start Snort, just like others have stated[1,2]:

/usr/local/bin/snort
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

It would help when starting from the GUI it would log this error. All I get is:

Jun 16 21:06:55	SnortStartup[16291]: Interface Rule START for 0_14987_em1...
Jun 16 21:06:54	SnortStartup[10750]: Toggle for 14987_em1...
Jun 16 21:03:35	SnortStartup[50953]: Interface Rule START for 0_14987_em1...
Jun 16 21:03:35	SnortStartup[45644]: Toggle for 14987_em1...
Jun 16 21:02:27	SnortStartup[36940]: Interface Rule START for 0_14987_em1...
Jun 16 21:02:27	SnortStartup[30983]: Toggle for 14987_em1...

In the system log.

Luckily I read this thread[1,2] and tried starting Snort from the terminal and got the error above.

Note, that Snort was [re]installed a few times; before I saw[1,2]. But kept getting those messages in the system log.

[1] http://forum.pfsense.org/index.php/topic,50301.0.html
[2] http://forum.pfsense.org/index.php/topic,50301.msg268889.html#msg268889

Gradius

Those crazy snort errors started with 2.9.2.3. :P

taryezveb

@Gradius:

Those crazy snort errors started with 2.9.2.3. :P

Never saw that here until today. But I was busy with other stuff and had not done anything with Snort; since 6/12 which would not install due to the barnyard package not being ready.

Thought would best for this error to have it's own thread. But if the mods don't agree, they will move it.

sprout

I also have exactly the same issue as taryezveb, same 2.0.1-RELEASE (amd64) and the same errors :-(

jimp

[jimp@files ~/tmp]$ cp /usr/local/www/files/packages/amd64/8/All/libdnet-1.11_3.tbz .
[jimp@files ~/tmp]$ tar xzf libdnet-1.11_3.tbz 
[jimp@files ~/tmp]$ file lib/libdnet.1 
lib/libdnet.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), not stripped
[jimp@files ~/tmp]$ file lib/libdnet.so
lib/libdnet.so: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), stripped

It's not a 32-bit/64-bit mismatch. (Though feel free to check your own /usr/local/lib/libdnet.1 using 'file' the same way).

compucoder

I have the exact same problem. I am on AMD 64 as well. Exact same version listed by the others. I have had numerous issues with the box since updating Snort to the latest package. I have also lost LightSquid - getting Server 500 error.

my system was running perfectly until I applied the latest Snort update.

Any ideas what we can try?

moe2006

Hi, I have the same problem with unsupported file layout, snort does not start any longer.

Just installed Pfsense 2.0.1 in a virtual box. Downloading package snort (2.2.1) fails. But snort dev package installation is working…

Atlantisman

I am having the same error, running 2.0.1-RELEASE (amd64) snort version 2.9.2.3 pkg v. 2.2.1

Is there a known fix for this yet?

Thanks.

compucoder

FYI,

I tried removing every single package installed post core install 2 months ago. I also cleaned up all config files and other files and folders left behind after the uninstall. I reinstalled just Snort by itself. I set it up right from scratch and when I started the interface I got the exact same error. It seems as if this is a problem with the Snort package or a dependency it is installing.

mbmb

Hello

I have the same problem as reported by many others, after upgrade of snort to 2.9.2.3 pkg v. 2.2.1, Snort won't start
anymore. When trying to start it from the command line i get:
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

I'm running 2.0.1-RELEASE (amd64)

Checking a few things:
file /libexec/ld-elf.so.1
/libexec/ld-elf.so.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, stripped
file /usr/local/lib/libdnet.1
/usr/local/lib/libdnet.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, not stripped

file /usr/local/bin/snort
/usr/local/bin/snort: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), dynamically linked (uses shared libs), for FreeBSD 8.1, stripped

Why is Snort a 32bit executable? in a supposedly 64bit package??????????????????

Hope someone comes up with a solution soon.

digdug3

Just wait for the dev to finish, or help him:

http://forum.pfsense.org/index.php/topic,50416.0.html

mschiek01

@mbmb:

Hello

I have the same problem as reported by many others, after upgrade of snort to 2.9.2.3 pkg v. 2.2.1, Snort won't start
anymore. When trying to start it from the command line i get:
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

I'm running 2.0.1-RELEASE (amd64)

Checking a few things:
file /libexec/ld-elf.so.1
/libexec/ld-elf.so.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, stripped
file /usr/local/lib/libdnet.1
/usr/local/lib/libdnet.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, not stripped

file /usr/local/bin/snort
/usr/local/bin/snort: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), dynamically linked (uses shared libs), for FreeBSD 8.1, stripped

Why is Snort a 32bit executable? in a supposedly 64bit package??????????????????

Hope someone comes up with a solution soon.

See this post:

http://forum.pfsense.org/index.php/topic,50609.0.html

jimp

remove/reinstall and see if this is OK now. I uploaded a new 64-bit binary package a few minutes ago.

feadin

@jimp:

remove/reinstall and see if this is OK now. I uploaded a new 64-bit binary package a few minutes ago.

It runs now, but there's a new error:

Jun 19 13:36:19	snort[5114]: FATAL ERROR: /usr/local/etc/snort/snort_13270_re0/snort.conf(324) Unknown output plugin: "alert_pf"
Jun 19 13:36:19	snort[5114]: FATAL ERROR: /usr/local/etc/snort/snort_13270_re0/snort.conf(324) Unknown output plugin: "alert_pf"

It only goes away if I disable the "Block Offenders" option, but I don't want to do that. That option is the main reason why I want to use snort.

mbmb

@mschiek01:

@mbmb:

Hello

I have the same problem as reported by many others, after upgrade of snort to 2.9.2.3 pkg v. 2.2.1, Snort won't start
anymore. When trying to start it from the command line i get:
/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

I'm running 2.0.1-RELEASE (amd64)

Checking a few things:
file /libexec/ld-elf.so.1
/libexec/ld-elf.so.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, stripped
file /usr/local/lib/libdnet.1
/usr/local/lib/libdnet.1: ELF 64-bit LSB shared object, x86-64, version 1 (FreeBSD), dynamically linked, not stripped

file /usr/local/bin/snort
/usr/local/bin/snort: ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD), dynamically linked (uses shared libs), for FreeBSD 8.1, stripped

Why is Snort a 32bit executable? in a supposedly 64bit package??????????????????

Hope someone comes up with a solution soon.

See this post:

http://forum.pfsense.org/index.php/topic,50609.0.html

Tried the above post, no luck!

Setting my hope to the newly build package

jimp

Whoops, how about now?

sprout

@jimp:

remove/reinstall and see if this is OK now. I uploaded a new 64-bit binary package a few minutes ago.

Great stuff jimp! the pig is flying again thanks to you :D

jimp

I'd prefer to see it roasting on a spit, but to each his own :p

feadin

Great! It's working now, thank you! :)
One last thing… the logs are all duplicated, both in the Alerts menu and in the System Logs too. Not only the alerts but all snort logs including the snort startup messages.
Regular non-snort logs are fine.

jimp

I'd start a new thread for anything that isn't directly related to the error in the subject line.

sronsen

Uninstalled, cleaned up left-over files and reinstalled from package installer.

Still getting /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

feadin

@sronsen:

Uninstalled, cleaned up left-over files and reinstalled from package installer.

Still getting /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

What exactly did you clean up? I had that problem but now it's fixed for me (found new problems though).
You may want to try doing a pkg_info to see all installed packages and then manually removing every related package with pkg_delete -f. The important packages you should remove are libpcap, libnet, libdnet, daq and of course snort as far as I remember. Also make sure you're not behind a proxy which may be caching the old files.

sronsen

@Feadin:

@sronsen:

Uninstalled, cleaned up left-over files and reinstalled from package installer.

Still getting /libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout

What exactly did you clean up? I had that problem but now it's fixed for me (found new problems though).
You may want to try doing a pkg_info to see all installed packages and then manually removing every related package with pkg_delete -f. The important packages you should remove are libpcap, libnet, libdnet, daq and of course snort as far as I remember. Also make sure you're not behind a proxy which may be caching the old files.

IT WORKED! I can't convey how much I appreciate the help after ten days of trying to get snort working again. I guess that one of the several packages I installed in that time had a bad libpcap, libnet, libdnet or daq package which wasn't being overwritten with a new snort install.

taryezveb

All is working great again. Would like to Thank jimp and the other Snort developers, that are working hard on the Snort package. Will donate again soon :D

Edit: To be clear, I'm talking about only this issue. Having other Snort issues similar to others on this forum.

dwood

This package does work now..however I could not stop the service. It says it's stopped, but blocking continues. You can stop the interfaces, but not the service via the dashboard.

To add SNORT HTTP_inspect suppression, (which ends up blocking pfsense.org if not added) I had to reboot the server. However, because pfsense.org was blocked, I ended up having the SQUID update fail partway through. On reboot…the PFSENSE install was damaged, so could shell in, but routing was broken. Ack.

Therefore fresh reinstall required....just a heads up! :-)