pf_ring

venkatesh bandari <[email protected]> Wed, 6 Nov 2019 11:56:40 +0800

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<CAKPzng-Qa_B-6r1zL1kfxSaFT0ECar9tcKVXLY4hu8CtCBTO4g@mail.gmail.com>

Hello Team,

i installed zeek and using standard libcap
ldd /opt/zeek/bin/zeek | grep pcap
        libpcap.so.1 => /lib64/libpcap.so.1 (0x00007f1bad618000)

iam seeing the box is dropping 40% packets.iam planning to have 2 more
workers with pf_ring.Installed pf_ring

in the link https://www.zeek.org/documentation/load-balancing.html
it says zeek to point to below libcap.how doi change the to pfring sware
libcap

ldd /usr/local/bro/bin/bro | grep pcap
        libpcap.so.1 => /opt/pfring/lib/libpcap.so.1

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek