Forgot to say that, for the benefit of newbies like me, the quick start instructions in
the Hyperscan site should include a line about installing, regardless of the build
method.
Had I used something like make -j8, I would have known that I needed to install
afterwards. Using cmake threw me off. By the way, make -j8 is much, much faster than
cmake. In case someone else reads this thread.
Thanks!
Sent from my mobile
On Nov 22, 2016, at 4:13 PM, Sec_Aficiondado
<secaficionado(a)gmail.com> wrote:
Hi Justin,
Thanks for your help. I had not installed Hyperscan, and that's why I did not have
the include/hs folder in my machine.
I had never used cmake before and I assumed that it would install after building (lame
assumption, in retrospect). After executing 'sudo make install', though, things
were in order.
I still can't build Snort, however. I haven't had enough time to dig deeper here,
but I confirmed that Snort builds successfully without Hyperscan. The Hyperscan-enabled
build fails in a file called hs.cpp with a bunch of "undefined" errors. I'll
go through the logs today or tomorrow to see if I can figure out exactly where the problem
is.
Thanks!
Sent from my mobile
> On Nov 17, 2016, at 5:43 PM, Viiret, Justin <justin.viiret(a)intel.com> wrote:
>
> Hi there,
>
> The configuration line from the README is assuming that you have built Hyperscan and
installed it in the directory "/opt/hyperscan-4.3.0" -- it needs to be pointed
at an installed set of Hyperscan libraries and headers. The include files you're
looking for should be installed by the Hyperscan 'make install' target.
>
> By default, if you haven't built Hyperscan with a custom install prefix,
'make install' should install the libraries and headers into /usr/local, so you
should use:
>
> $ ./configure --enable-intel-hyperscan \
> --with-hyperscan-includes=/usr/local/include/hs \
> --with-hyperscan-libraries=/usr/local/lib
>
> There should be no problem using Hyperscan 4.3.2 and Snort 2.9.8.3 with this patch --
let us know if you run into any more problems.
>
> Best regards,
> Justin
>
> -----Original Message-----
> From: Hyperscan [mailto:hyperscan-bounces@lists.01.org] On Behalf Of Sec_Aficiondado
> Sent: Friday, November 18, 2016 8:53 AM
> To: hyperscan(a)lists.01.org
> Subject: [Hyperscan] Help with Snort integration
>
> Hello,
>
> I am trying to build Snort with Hyperscan but I got stuck in the config step, just
before building Snort.
>
> The readme file says to configure Snort as follows:
> $ ./configure --enable-intel-hyperscan
--with-intel-hyperscan-includes=/opt/hyperscan-4.3.0/include/hs...
>
> However, I do not have that folder "include/hs" anywhere in my machine.
>
> For background, I'm building everything on a VM with Ubuntu 16.04. Processor is
i5 haswell, but only building barebones functionality (compiler options -mssse3 -mpopcnt).
Snort is 2.9.8.3 and Hyperscan is 4.3.2.
>
> I know the tested versions are not the latest but everything is building without
problems with the current versions. The Snort patch also went smoothly.
>
> The question is: do I need the include/hs folder to build Snort, and if so, where do
I find it?
>
> Thanks in advance for your help!
>
> Sec Aficionado
> Sent from my mobile