RHEL 5/CentOS 5 Users
As of Snort 2.9.0, and DAQ, Snort now requires the use of a libpcap version greater than 1.0. Unfortunately for people using RHEL 5 (and below), CentOS 5.5 (and below), and Fedora Core 11 (and below), there is not an official RPM for libpcap 1.0.
Sourcefire will not repackage libpcap and distribute libpcap with Snort as part of an RPM, as it may cause other problems and will not be officially supported by Redhat.
This leaves you with a simple option:
Compile Libpcap on your own. Get the Source code here.
Sourcefire will always recommend that you download and compile Snort from its source (and in this case, downloading and compiling libpcap from source as well). Snort’s source code is available from our website here.
If there are any questions, please feel free to write the Mailing Lists.