[nSLUG] Snort doesn't on debian sparc

Ben Armstrong synrg at sanctuary.nslug.ns.ca
Fri Mar 28 08:38:37 AST 2003

On Thu, 2003-03-27 at 12:37, Donald Teed wrote:
> I've tried everything, up to building my own 2.0 rc1 snort
> on the sparc platform.  No way around getting a bus error
> when running a basic 'snort -dvi eth0' test.
> It does report about 4 lines before bombing, which
> is a little better than with the snort 1.8 I found in the
> debian packages, but still no go.  Googling on the error located
> references to GCC problems in the snort mailing list
> archives, and I tried CC - no difference.

Hm.  I think you don't need to go any further than the Debian bug


And in particular:


Reading further down in this bug report:

"A liberal application of GCC __attribute__ ((packed)) directives kills all
the sparc SIGBUS problems I have experienced and allows me to run with
all the bells and whistles that I've tried so far.  This will probably
help in the HPPA case as well.

I was compiling 1.9.0rel this on a freshly updated unstable using CC=gcc-3.2,
I haven't tried with any other configurations yet.  My machine hw config
is above in the thread for BUG#102772 (Note I had to upgrade to kernel
2.4.19 because the new pcap was crashing the kernel when promiscuous mode
was left.)

Of course this patch will only compile with GCC, so the upstream will
have to play with some macro/autotools magic to get it working under other CCs.
I'm also not sure if any of the attributes are unnecessary or whether I've
missed any in any other files that are going to bite me later.

Patch attached.  If noone steps up to test on HPPA I might be
able to try, if my parisc box survives a dist-upgrade."

Now, since then, 1.9.1 has entered unstable.  You'd have to examine the
source to see if this patch has made it into upstream.

If you haven't tried it, I'd fetch the Debian source package either for
1.9.0rel or 1.9.1) and all of its source dependencies, apply this patch
(if needed - check if 1.9.1 still needs it or not,) and then build it
with "debuild -uc -us".  I'm assuming you're using Debian "testing"? 
I'm not sure if all of the build depends are all satisfiable for testing
on the sparc platform, but here they are:

Build-Depends: libnet0-dev, libpcap-dev, debhelper (>= 2.1.28),
libmysqlclient-dev, libsnmp4.2-dev, postgresql-dev, libpq3, libssl-dev

Also, make sure you're compiling with gcc-3.2 (gcc --version to verify
which version you have installed) and if it isn't your default gcc,
override it in the environment.

Ben Armstrong <synrg at sanctuary.nslug.ns.ca>

More information about the nSLUG mailing list