# Compiling Bro with Endace Dag Support
**URL:** https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873
**Category:** Zeek
**Created:** [October 28, 2013, 10:02pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873 "2013-10-28T22:02:25Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Benjamin\_Wood](https://community.zeek.org/u/Benjamin_Wood)
#### Post date: [October 28, 2013, 10:02pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/1 "2013-10-28T22:02:25Z")
All,
Is this functionality still supported?
I believe I’ve been able to get bro to use libpcap compiled with dag libraries, but is there native support?
I remember reading somewhere that I could run “./configure --with-dag” to compile bro with dag support.
If not I’ll just recompile libpcap with the dag libraries, and then recompile bro with the new libpcap.
Thanks,
Ben Wood
---
### Author:  [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)
#### Post date: [October 28, 2013, 10:50pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/2 "2013-10-28T22:50:17Z")
Can’t speak for what’s actually supported, but I’ve not been disappointed with using libpcap with DAG, bro vs that libpcap.
That said, use pcap 1.3.0. 1.4.0 had some issues, can’t recall their precise nature but “they don’t work at all” sticks in the mind. 🙂
Mike
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [October 29, 2013, 1:33pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/3 "2013-10-29T13:33:30Z")
The native DAG support was removed a while ago but I believe the pcap
wrapper should work fine.
Robin
---
### Author:  [@Benjamin\_Wood](https://community.zeek.org/u/Benjamin_Wood)
#### Post date: [October 29, 2013, 9:51pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/4 "2013-10-29T21:51:59Z")
Thanks, I eventually got it to compile and run correctly.
Turns out ./configure was targeting the system libpcap that was installed before the dag drivers.
– Found PCAP: /usr/lib64/libpcap.so
instead of the “post-dag” compiled one in /usr/local/lib
Even when I tried “./configure --with-pcap=/usr/local/lib” it still favored the system libpcap. I don’t know if this is by design.
My eventual solution was to remove the system libpcap. Once it was gone, ./configure for bro found the one in /usr/local/lib.
– Found PCAP: /usr/local/lib/libpcap.so
Cheers,
Benjamin Wood
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [October 30, 2013, 2:10pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/5 "2013-10-30T14:10:10Z")
> Even when I tried "./configure --with-pcap=/usr/local/lib" it still favored the system libpcap. I don't know if this is by design.
You should use --with-pcap=/usr/local
The configure script needs to find the header and the library so you give the installation prefix.
> My eventual solution was to remove the system libpcap. Once it was gone, ./configure for bro found the one in /usr/local/lib.
> -- Found PCAP: /usr/local/lib/libpcap.so
This worked because /usr/local/ is a secondary search path.
.Setb
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/compiling-bro-with-endace-dag-support/2873/6 "2022-05-06T15:41:20Z")