[Bro] RHEL 4.0/endace 10GigE/Bro

[David Vasil]

Looks like it cant find some header files for libpcap.

I have a very similar setup to what you are doing, here is the skinny on 
how I configured my DAG cards with DAG compatible libpcap and bro:

I got the libpcap source from endace.com's website, then compiled with 
the following:
./configure '--with-dag=/opt/dag' '--prefix=/opt' && make
make install

For bro using bro-1.X:
CFLAGS='-I/opt/include' LDFLAGS='-L/opt/lib' ./configure 
'--disable-localpcap' '--enable-selectloop' '--prefix=/opt/bro-1.0' && make
make install

You will need to use endace's libpcap until bro supports DAG devices 
natively.  The endace-libpcap allows the dag devices to be seen as dag0 
and dag1 (sort of like eth0/eth1).

-- 
| David Vasil <dmvasil at ornl.gov>
| Oak Ridge National Laboratory NCCS Division
| High Performance Computing Systems Administrator
| Bldg: 5600-A115  Phone: (865)241-5562