problem compiling Barnyard2

[Rich Lee]

HI,
am installing Barnyard2 according to instructions here: Snort install instructions although they seem pretty simple and common. I'm in a 64-bit Ubuntu 14.04 VirtualBox VM.

$ sudo apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtool

$ wget https://github.com/firnsy/barnyard2/archive/master.tar.gz -O barnyard2 -2-1.13.tar.gz

$ tar zxvf barnyard2-2-1.13.tar.gz

$ cd barnyard2-master

$ autoreconf -fvi -I ./m4
$ ./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu


// all good so far...
then 'make' gives this output (full output on http://pastebin.com/ktQvVN0j)

make[3]: Entering directory `/home/nemesis/snort_src/firnsy-barnyard2-2d209b9/src'
gcc -DHAVE_CONFIG_H -I. -I..  -Isfutil -I/usr/include/mysql -DENABLE_MYSQL  -g -O2 -fno-strict-aliasing -Wall -c -o barnyard2.o barnyard2.c
gcc -DHAVE_CONFIG_H -I. -I..  -Isfutil -I/usr/include/mysql -DENABLE_MYSQL  -g -O2 -fno-strict-aliasing -Wall -c -o debug.o debug.c
gcc -DHAVE_CONFIG_H -I. -I..  -Isfutil -I/usr/include/mysql -DENABLE_MYSQL  -g -O2 -fno-strict-aliasing -Wall -c -o decode.o decode.c
decode.c:38:18: fatal error: dnet.h: No such file or directory
 #include <dnet.h>
                  ^
compilation terminated.

I can't find any references to this error via Google, so I'd appreciate any pointers. Thing is... this worked fine for me just yesterday.
TIA
Rich

[Jeremy Hoel]

You need to have libdnet installed..   and it's not the one from apt

http://blog.linton.tw/posts/2014/08/16/install-snort-from-source-on-ubuntu

Unzip, make and install Libdnet

$ tar zxvf libdnet-1.12.tgz

$ cd libdnet-1.12/

$ ./configure CFLAGS=-fPIC; make

$ sudo checkinstall

$ sudo dpkg -i libdnet_1.12-1_amd64.deb

$ sudo ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1

--

---
You received this message because you are subscribed to the Google Groups "barnyard2-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to barnyard2-use...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Jeremy Hoel]

Also.. maybe this - http://ubuntuforums.org/showthread.php?t=1883228

I do it all via source on CentOS.. but the cause is the same..  dnet's headers are missing.

[Rich Lee]

HI Jeremy,
thanks for your response: it worked for me.

I'm still uh, 'taxed' by the discovery that the definitive instructions on snort.org don't actually work. I'm seeing this kind of thing all the time on the linux platform, particularly Ubuntu. In this case looks like Barnyard2 is old enough to pre-date Ubuntu 12's rename of libdnet to libdumbnet, and the guy who wrote the instructions didn't test them on a clean OS... but you'd have thought that *sometimes* since Ubuntu 12 *somebody* would have noticed this... I'm clearly missing something important.

But maybe I can ask you (bc I'm trying to work out how I could have fixed this myself):
- why you say that the libdnet version required isn't the one from apt? How did you know we needed the code.google version 1.12 rather than 1.12-1? (I thought the -1 just meant it was just a debian version, not that there are any changes)
- Is code.google.com the definitive source for the package? If yes then howcome apt seems to have a later version, and if not then where *is* the definitive repo?

Cheers
Rich
- then your advice to use a non-APT repo for dnet got me the dependency I needed. However: AFAIK in Ubuntu 12 libdnet was renamed to libdumbnet, and in fact those instructions on Snort.org *did* include installing libdumbnet. So leaving aside the question of how the Snort guy didn't notice that, we're left with Barnyard2 actually being pretty old and seemingly having had no code updates for 

[Rich Lee]

Uh, ignore the chaff after my sig
R

[Jeremy Hoel]

Well I run most of my stuff on CentOS, and I also prefer source to the packages for some things.. it's faster and I know what it's doing. So along the way I've learned what the carious errors mean.  It's not a hard problem, and having two different dnet libraries doesn't help, but it's an easy fix.   Send up a message to the person on the snort mailing list or to the person that volunteered the docs (Since I think they are contributed, not from Sourcefire/Cisco directly) and they can fix it.

Looking at the PDF you reference, on page 3 it lists some prereqs.. 

"sudo apt - get install -y libpcap - dev libpcre3 - dev libdumbnet - dev"

For barnyard2, this is the source I go too - https://github.com/firnsy/barnyard2   I don't know which code.google project you are referring too.  

The barnyard source doesn't care about the distro, only that the libraries it needs are available.  The person doing the packaging for ubuntu probably needs to update that.  But I would jsut build from source.. you'll get more control and better understand what parts are needed to make it work.

--

[Rich Lee]

Thanks Jeremy - really helpful.

Rich

[Noah Dietrich]

Hi Rich,

I'm not sure if someone has answered your question. i am the author of the original document you refrerenced, and I wanted to make sure you got everythign working.

There is some confusion about the dnet libary required for Snort and for Barnyard2 on the ubuntu system:

The dnet library can be installed from souce (as shown in other posts) and will work without issue. If you look in the earlier sections of the install document, it shows that you should install the libdubmnet-dev library (sudo apt-get install libdubmnet-dev). this provides the dnet library. if you tried isntalling the dnet library this way: sudo apt-get install dnet, then you will have issues, as that is the incorrect library.  If you installed the incorrect library, you must uninstall it, then install the correct library either from source or from the ubuntu repository.

once the library is installed, you must run sudo ldconfig to make the libraries avaliable to the system. if you don't run that command before you try to use them (during the make process of Barnyard2 for example), then you will see the errors you encountered, as the libraries are not avaliable to the system.

So in closing, running the following two commands should make Barnyard2 compile:

$ sudo apt-get install libdubmnet-dev

$ sudo ldconfig

The instructions in the guide are written to setup the entire snort system with supporting software. if you were using the guide to just install Barnyard2 on it's own, some of the steps from the section on installing Snort are pre-requisites, as Snort uses them.  Continue to install as per the rest of the guide.  If you continue to have issues, please let me know so I can determine the issue and update the guide as needed.

Noah

[Rich Lee]

Thanks Noah, I appreciate you taking the time.

Your latest (Jan 15) document at the snort docs page is clear in section 7. Thanks for the update.

I do have Snort + Barnyard2 running fine, and I've done several installs. While I have tested with a live data feed I'm actually using the setup for offline analysis of pre-captured packets. Works great.

Part of my original WTF was the lib naming confusion going back into Debian history / folklore. But I realise I'm late to the game, and it was actually resolved several years ago.

Cheers!
Rich

[ty...@ospreyinformatics.com]

HI Rich and Noah,

I was encountering the same issue using Ubuntu 14.04  even with libdumbnet-dev installed and running ldconfig prior to tryingto build barnyard2.

The following symlink fixed the issue:

ln -s /usr/include/dumbnet.h /usr/include/dnet.h
ldconfig

I'm not sure if the ldconfig is necessary or not.

Thought I would post it here in case anyone encounters the same issue.

Cheers,
Tyler

[Lin Wang]

It appears to be caused by commit 4a4a05c61c2f888e796cfcb990585988f8b42733.

Even though the code contains a check for existence of dumbnet.h, the condition is not actually set anywhere.

+#ifdef HAVE_DUMBNET_H

+#include <dumbnet.h>

+#else

+#include <dnet.h>

+#endif

[Chris Wolski]

Tyler,

Thanks for the note on linking.  Works just fine.

[Dani Glore]

That symlink worked perfectly for me on Ubuntu 12.04

-Dani

On Friday, April 17, 2015 at 4:19:49 PM UTC-4, ty...@ospreyinformatics.com wrote:

[François-xavier]

Hi every one,

i am getting the same issue, i'm trying to install barnyard2 on centos7 and i have the same error " decode.c:38:18: erreur fatale: dnet.h : Aucun fichier ou dossier de ce type  #include <dnet.h> " .
 i have already install:  libnet-1.1.6-7.el7.x86_64 but i can't find the dnet.h in the /usr/include/ directory .

Could any one help me ??

Thanks

[David Whitehead]

I've been bang'n on this same problem myself for several hours now... same error... went through all the same things above... and still the same error. Barnyard2 simply will not compile.

Any forum that even mentions this issue... tried all that too... completely removed everything and started all over... still no go.  <face-palm>

Setting it aside for a while...   *sigh*

[James Lay]

--

---
You received this message because you are subscribed to the Google Groups "barnyard2-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to barnyard2-use...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

You're missing libdnet:

https://github.com/dugsong/libdnet

James

[Neil Singer]

Tyler -

Thanks for the tip on the symlink (dumbnet.h -> dnet.h) .  That was the key for my build to complete.

Neil

[Hawkar Taha]

I got the same problem as Rich

I followed Noah's instruction

But this fixed my issue

Thanks a lot

[Noah Dietrich]

here is the root of this issue:  if you are using the latest version of barnyard2 (master), downloaded from the barnyard2 git page (the most current master: https://github.com/firnsy/barnyard2/archive/master.tar.gz), then you will get this error, which as mentioned above can be fixed by linking the actual dnet library (dumbnet.h, installed with apt-get install lib-dumbnet) with dnet.h, which is what barnyard2 is expecting. 

ln -s /usr/include/dumbnet.h /usr/include/dnet.h
ldconfig

if you install the most recent formal release of barnyard2 (not the master), version 2-1.13 (https://github.com/firnsy/barnyard2/archive/v2-1.13.tar.gz) then you won't get this error.  I guess there was a patch applied between the formal release and now that changed the name of the dnet library.  I've added this note to my updated guide so that it doesn't cause issues in the future.

looking at github, i do note the following line in decode.c:

#ifdef HAVE_DUMBNET_H #include <dumbnet.h> #else #include <dnet.h> #endif

so it is probably related to that.

--

[Ronny Lindner]

Am Sonntag, 8. November 2015 18:55:35 UTC+1 schrieb Noah Dietrich:
> here is the root of this issue:  if you are using the latest version of barnyard2 (master), downloaded from the barnyard2 git page (the most current master: https://github.com/firnsy/barnyard2/archive/master.tar.gz), then you will get this error, which as mentioned above can be fixed by linking the actual dnet library (dumbnet.h, installed with apt-get install lib-dumbnet) with dnet.h, which is what barnyard2 is expecting. 
> ln -s /usr/include/dumbnet.h /usr/include/dnet.h
> ldconfig
>
>
>
> if you install the most recent formal release of barnyard2 (not the master), version 2-1.13 (https://github.com/firnsy/barnyard2/archive/v2-1.13.tar.gz) then you won't get this error.  I guess there was a patch applied between the formal release and now that changed the name of the dnet library.  I've added this note to my updated guide so that it doesn't cause issues in the future.
>
>
>
> looking at github, i do note the following line in decode.c:
>
>
> #ifdef HAVE_DUMBNET_H
> #include <dumbnet.h>
> #else
> #include <dnet.h>
> #endif
>
>
>
> so it is probably related to that.
>
>
>

Instead of creating the symlink you can change configure.ac before doing ./autogen.sh:
https://github.com/firnsy/barnyard2/pull/214/files

This completes the dumbnet.h check you found.