Re: pf_ring

Michał Purzyński <[email protected]> Wed, 6 Nov 2019 15:41:28 -0800

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<CAJ6bFK0C=uDp2KZte0K-uyi06nx9tnvqvuwcPSaTJfQ+JNRhrw@mail.gmail.com>

Why not give AF_Packet a try? We have an official zpkg package and a
plugin, with some instructions here
https://github.com/J-Gras/bro-af_packet-plugin

On Tue, Nov 5, 2019 at 8:05 PM venkatesh bandari <[email protected]>
wrote:

> Hello Team,
>
> i installed zeek and using standard libcap
> ldd /opt/zeek/bin/zeek | grep pcap
>         libpcap.so.1 => /lib64/libpcap.so.1 (0x00007f1bad618000)
>
> iam seeing the box is dropping 40% packets.iam planning to have 2 more
> workers with pf_ring.Installed pf_ring
>
> in the link https://www.zeek.org/documentation/load-balancing.html
> it says zeek to point to below libcap.how doi change the to pfring sware
> libcap
>
> ldd /usr/local/bro/bin/bro | grep pcap
>         libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek