The following instructions apply if you have a Linux or FreeBSD platform andwant libpcap to support the DAG range of passive network monitoring cards fromEndace (http://www.endace.com, see below for further contact details).1) Install and build the DAG software distribution by following theinstructions supplied with that package. Current Endace customers can downloadthe DAG software distibution from https://www.endace.com2) Configure libcap. To allow the 'configure' script to locate the DAGsoftware distribution use the '--with-dag' option:        ./configure --with-dag=DIRWhere DIR is the root of the DAG software distribution, for example/var/src/dag. If the DAG software is correctly detected 'configure' willreport:        checking whether we have DAG API... yesIf 'configure' reports that there is no DAG API, the directory may have beenincorrectly specified or the DAG software was not built before configuringlibpcap.See also the libpcap INSTALL.txt file for further libpcap configurationoptions.Building libpcap at this stage will include support for both the native packetcapture stream (linux or bpf) and for capturing from DAG cards. To buildlibpcap with only DAG support specify the capture type as 'dag' whenconfiguring libpcap:        ./configure --with-dag=DIR --with-pcap=dagApplications built with libpcap configured in this way will only detect DAGcards and will not capture from the native OS packet stream.----------------------------------------------------------------------Libpcap when built for DAG cards against dag-2.5.1 or later releases:Timeouts are supported. pcap_dispatch() will return after to_ms millisecondsregardless of how many packets are received. If to_ms is zero pcap_dispatch()will block waiting for data indefinitely.pcap_dispatch() will block on and process a minimum of 64kB of data (beforefiltering) for efficiency. This can introduce high latencies on quietinterfaces unless a timeout value is set. The timeout expiring will overridethe 64kB minimum causing pcap_dispatch() to process any available data andreturn.pcap_setnonblock is supported. When nonblock is set, pcap_dispatch() willcheck once for available data, process any data available up to count, thenreturn immediately.pcap_findalldevs() is supported, e.g. dag0, dag1...Some DAG cards can provide more than one 'stream' of received data.This can be data from different physical ports, or separated by filteringor load balancing mechanisms. Receive streams have even numbers, e.g.dag0:0, dag0:2 etc. Specifying transmit streams for capture is not supported.pcap_setfilter() is supported, BPF programs run in userspace.pcap_setdirection() is not supported. Only received traffic is captured.DAG cards normally do not have IP or link layer addresses assigned asthey are used to passively monitor links.pcap_breakloop() is supported.pcap_datalink() and pcap_list_datalinks() are supported. The DAG card doesnot attempt to set the correct datalink type automatically where more thanone type is possible.pcap_stats() is supported. ps_drop is the number of packets dropped due toRX stream buffer overflow, this count is before filters are applied (it willinclude packets that would have been dropped by the filter). The RX streambuffer size is user configurable outside libpcap, typically 16-512MB.pcap_get_selectable_fd() is not supported, as DAG cards do not supportpoll/select methods.pcap_inject() and pcap_sendpacket() are not supported.Some DAG cards now support capturing to multiple virtual interfaces, calledstreams. Capture streams have even numbers. These are available via libpcapas separate interfaces, e.g. dag0:0, dag0:2, dag0:4 etc. dag0:0 is the sameas dag0. These are visible via pcap_findalldevs().libpcap now does NOT set the card's hardware snaplen (slen). This must now beset using the appropriate DAG coniguration program, e.g. dagthree, dagfour,dagsix, dagconfig. This is because the snaplen is currently shared betweenall of the streams. In future this may change if per-stream slen isimplemented.DAG cards by default capture entire packets including the L2CRC/FCS. If the card is not configured to discard the CRC/FCS, thiscan confuse applications that use libpcap if they're not prepared forpackets to have an FCS. Libpcap now reads the environment variableERF_FCS_BITS to determine how many bits of CRC/FCS to strip from theend of the captured frame. This defaults to 32 for use withEthernet. If the card is configured to strip the CRC/FCS, then setERF_FCS_BITS=0. If used with a HDLC/PoS/PPP/Frame Relay link with 16bit CRC/FCS, then set ERF_FCS_BITS=16.----------------------------------------------------------------------Please submit bug reports via <support@endace.com>.Please also visit our Web site at:        http://www.endace.com/For more information about Endace DAG cards contact <sales@endace.com>.