I am working with the libpcap + ringbuffer and trying to get it moved from Debian to Red Hat. The Debian/Slackware code depends upon /usr/include/linux/system.h which has the kernel version of asm.h linked to if for the platform. For i386 this is asm-i386.h which has the macro mb(); that the pcap ringbuffer code relies on to make sure some obscure race conditions are taken of. [I do not know what the race condition is beyond it talking to the kernel half of the ringbuffer.] Anyway it compiles well on the other Linux versions we have because it can find the call to mb() without problems. On Fecore Core 3 (and most likely RHEL4) it does not work at all because of kernel system.h now in /lib/modules/.... What is the best way of dealing with items like this? -- Stephen J Smoogen. CSIRT/Linux System Administrator