[Bro] Compiling Bro with Endace Dag Support

[Benjamin Wood]

Thanks, I eventually got it to compile and run correctly.

Turns out ./configure was targeting the system libpcap that was installed
before the dag drivers.
-- Found PCAP: /usr/lib64/libpcap.so
instead of the "post-dag" compiled one in /usr/local/lib

Even when I tried "./configure --with-pcap=/usr/local/lib" it still favored
the system libpcap. I don't know if this is by design.

My eventual solution was to remove the system libpcap. Once it was gone,
./configure for bro found the one in /usr/local/lib.
-- Found PCAP: /usr/local/lib/libpcap.so

Cheers,

Benjamin Wood


On Tue, Oct 29, 2013 at 9:33 AM, Robin Sommer <robin at icir.org> wrote:

>
>
> On Mon, Oct 28, 2013 at 18:02 -0400, you wrote:
>
> > Is this functionality still supported?
>
> The native DAG support was removed a while ago but I believe the pcap
> wrapper should work fine.
>
> Robin
>
> --
> Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
> ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131029/c5602799/attachment.html