Snort3 on Ubuntu RPi5 help

Good morning to the list,

I have a few RPi5 servers that are connected to the internet. Most of 
which serve as a data over RF functionality.

I have Ubuntu Pi 64bit OS enabled on these mini-servers. I do have Snort 
2.9.20 running successfully that are updated by PulledPork.

I have been trying to compile Snort3 using various Ubuntu howto's which 
has been a challenge. I did finally get successful compile completed 
yesterday. Basically, I had to go to each dependency and compile the 
latest versions from Github and other source locations.
After the successful Snort3 compile and install, I have met another wall 
relating to the aarch64 cpu architecture. The errors appear to be 
libc6-dev and libunwind-dev. Here is the Backtrace output:

Snort (PID 475020) caught fatal signal: SIGABRT (6)
Version: 3.6.3.0

Backtrace:
   #0 0xffff958c7608 in pthread_key_delete+0x1a8 
(/lib/aarch64-linux-gnu/libc.so.6 @0xffff95840000)
   #1 0xffff9587cb3c in gsignal+0x1c (/lib/aarch64-linux-gnu/libc.so.6 
@0xffff95840000)
   #2 0xffff95867e00 in abort+0xf4 (/lib/aarch64-linux-gnu/libc.so.6 
@0xffff95840000)
   #3 0xffff96046dd4 in _Unwind_GetTextRelBase+0x2388 unw_get_proc_info 
failed: unsupported operation or bad value (4294967288)
   #4 0xffff96046dd4 in _Unwind_GetTextRelBase+0x2388 unw_get_proc_info 
failed: unsupported operation or bad value (4294967288)

Aborted (core dumped)

I have taken the latest Github libunwind-1.8.1 and completed the build 
and install.
I could not find a similar libc6-dev source. However, I did purge the 
application and reinstalled it.
apt install libc6-dev
apt install build-essential

Everything compiles fine, but no SNORT3
Another thing is that I used the following to configure the Snort3 
build.
./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc

I have never used tcmalloc before. I did install gperftools-2.16 to 
support it.

The questions are:
Has anyone successfully compiled a working Snort3 on a Ubuntu 24.04 
RPi5?
Is there anything that I can do to solve the aarch64 libc.so.6 and 
Unwind errors?

Close but no cigar, yet....
At least the Debian Snort2 v2.9.20 is working well.
I am open to constructive suggestions and help at this point

V/R
JohnF



-- 
V/R
John Feist
CISSP, CISA, C|CISO, CEH, CPT
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette