Craig Leres is working on porting Bro to our local Linux box (the earlier
patches were contributed by a 0.3 alpha tester for their particular Linux
system). Expect a 0.5 release soon.
There was a question earlier about replacing a use of "bgp" with 179/tcp
and speculation that this is because the compiler reads /etc/services.
That's right. This has turned out to be a portability headache. I guess
the right way to fix it is to predefine a bunch of names for particular
ports; I'm not all that happy with such a solution, though, because it
eats up id's from the namespace, some of which are of no interest at all
in some environments.
Vern