debian "binary" package on apt repository

[Tim Small <tim@xxxxxxxxxxxxx>]

Hi,

I tried using the firestorm 0.5.4 deb from the apt repository at 
http://www.scaramanga.co.uk/ today, without much success...


First of all, the init script launches a libtool script, which expects 
to find object files under /root/firestorm-0.5.4 (which aren't included 
in the .deb).

If I rebuild the deb package from this and install it (all this is on 
i386/testing), I get this on startup:


1066147007.511575 info: plugin: preproc.spoon[0.1]: S.P.O.O.N. Anomaly 
Detection
1066147007.513158 info: plugin: matcher.icmp[2.0]: ICMP matching routines
1066147007.514735 info: plugin: matcher.http[0.1]: HTTP matching routines
1066147007.516445 info: plugin: matcher.dns[0.1]: DNS matching routines
1066147007.517607 error: exit: capture: cant find 'pcap'
1066147007.520996 info: loader: unloading all plugins
1066147007.524350 debug: cleanup: exit with code 1

stracing the binary gives:

19960 open("/usr/lib/firestorm/capture/capdev_pcapfile.so", O_RDONLY) = 4
19960 read(4, "\177ELF"..., 512) = 512
19960 fstat64(4, {st_mode=S_IFREG|0644, st_size=5576, ...}) = 0
19960 old_mmap(NULL, 4540, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 
0x40157000
19960 old_mmap(0x40158000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED, 4, 0x1000) = 0x40158000
19960 close(4)                          = 0
19960 open("/root/firestorm-0.5.4/src/.libs/libpcap.so.0.7", O_RDONLY) = 
-1 ENOENT (No such file or directory)
19960 open("/etc/ld.so.cache", O_RDONLY) = 4
19960 fstat64(4, {st_mode=S_IFREG|0644, st_size=9702, ...}) = 0
19960 old_mmap(NULL, 9702, PROT_READ, MAP_PRIVATE, 4, 0) = 0x40159000
19960 close(4)                          = 0
19960 open("/usr/lib/libpcap.so.0.7", O_RDONLY) = 4
19960 read(4, "\177ELF"..., 512) = 512
19960 fstat64(4, {st_mode=S_IFREG|0644, st_size=113040, ...}) = 0
19960 old_mmap(NULL, 114008, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 
0x4015c000
19960 old_mmap(0x40177000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED, 4, 0x1b000) = 0x40177000
19960 close(4)                          = 0
19960 munmap(0x40159000, 9702)          = 0
19960 gettimeofday({1066147007, 472371}, NULL) = 0




So it looks happy to me...



Also, any chance of web archive of this mailing list (ezmlm-idx does 
this, I think)?




Cheers,

Tim.