Thanks, Nan.

I see the issue you are dealing with and I can understand the frustration. This is typical with some of the more active and popular open source software and the Mac. Especially when using a package manager like MacPorts and Fink. Mac users can count on being the last to get updates to FLOSS software and usually we have to hack our way into running the latest stuff.

I would not go down the RPM route as you were trying to do. I would instead compile Snort from source. Believe it or not I have found the IBM developers site a great resource for learning how to setup and configure open source stuff. Some of it may be a little dated but the methods still apply and I think may get you where you would like to go with a Snort install on Mac 10.6. I haven’t tried this yet but will at some point and will post my findings.
Installing Snort from source code

I have tried installing snort on Mac OS X 10.6.5 via:

Updating all my ports:
sudo port selfupdate
sudo port upgrade outdated

Installing snort via MacPorts which seems to also be called Darwin (why two names I don’t know)
sudo port install snort

The version installed (via snort -V) is snort 2.6.1.5 … but the latest is snort 2.9.0.1

And the latest rules (snortrules-snapshot-2900) is not compatible,

So then I tried installing RPM via Mac Ports and trying to install the RPM version but when I attempted rpm -ivh snort-1.8.6-1snort.i386.rpm it immediately failed saying “segmentation fault.”

So then I tried getting the source and typing ./configure and it says…

ERROR! dnet header not found, go get it from
http://code.google.com/p/libdnet/ or use the –with-dnet-*
options, if you have it installed in an unusual place

So I tried installing this via the DMG but it complained that it needed Python 2.5.

So I installed the latest Python 2 series, which is 2.7 and it still complained that it needed 2.5.

So then I installed the Python 2.5 universal binary DMG and it installed…

But I still this message when attempting to configure:

ERROR! dnet header not found, go get it from
http://code.google.com/p/libdnet/ or use the –with-dnet-*
options, if you have it installed in an unusual place

So bottom line is:

I can’t make snort work on the mac with updated signatures.

If you happen to have the answer it it would be much appreciated, and if you have an amazon wish list or a way to donate to any missions that are important for you personally, please be in touch with your info. Thanks!