<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">The package likely isn’t compatible with Zeek 3.1 yet, since it introduced significant changes. However, you can install pf_ring without using zkg: <a href="https://docs.zeek.org/en/current/configuration/#installing-pf-ring" class="">https://docs.zeek.org/en/current/configuration/#installing-pf-ring</a><div class=""><br class=""></div><div class="">That said, the general recommendation nowadays is to go with af_packet, of which there is a Zeek 3.1 compatible package: <a href="https://packages.zeek.org/packages/view/6dedb9cc-5916-11ea-9321-0a645a3f3086" class="">https://packages.zeek.org/packages/view/6dedb9cc-5916-11ea-9321-0a645a3f3086</a></div><div class=""><br class=""></div><div class="">If you go that route, I’ve written a guide to get you started: <a href="https://www.ericooi.com/zeekurity-zen-part-ii-zeek-package-manager/" class="">https://www.ericooi.com/zeekurity-zen-part-ii-zeek-package-manager/</a></div><div class=""><br class=""></div><div class="">Hope that helps!</div><div class="">Eric<br class=""><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 10, 2020, at 5:57 PM, Greg Grasmehr <<a href="mailto:greg.grasmehr@caltech.edu" class="">greg.grasmehr@caltech.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Greetings,<br class=""><br class="">I'm trying to use zkg to install pf_ring, I have zeek 3.1.1 source<br class="">available, and the following in the config, but it still errors with<br class=""><br class="">Cannot determine Bro source directory, use --bro-dist=DIR<br class=""><br class="">Having bro_dist defined in the config makes no difference<br class=""><br class="">cat .zkg/config <br class="">[sources]<br class="">zeek = <a href="https://github.com/zeek/packages" class="">https://github.com/zeek/packages</a><br class=""><br class="">[paths]<br class="">state_dir = /home/zeek/.zkg<br class="">script_dir = /opt/zeek/share/zeek/site<br class="">plugin_dir = /opt/zeek/lib/zeek/plugins<br class="">zeek_dist = /tmp/zeek-3.1.1<br class="">bro_dist = /tmp/zeek-3.1.1<br class=""><br class=""><br class=""><br class=""><br class="">zkg --verbose install zeek/ntop/bro-pf_ring<br class="">The following packages will be INSTALLED:<br class=""> zeek/ntop/bro-pf_ring (master)<br class=""><br class="">Proceed? [Y/n] Y<br class="">Running unit tests for "zeek/ntop/bro-pf_ring"<br class="">error: failed to run tests for zeek/ntop/bro-pf_ring: package build_command failed, see log in /home/zeek/.zkg/logs/bro-pf_ring-build.log<br class="">Proceed to install anyway? [N/y] N<br class="">Abort.<br class=""><br class=""><br class=""><br class="">cat /home/zeek/.zkg/logs/bro-pf_ring-build.log<br class="">=== STDERR ===<br class="">=== STDOUT ===<br class="">Cannot determine Bro source directory, use --bro-dist=DIR.<br class=""><br class="">Thanks for any pointers.<br class=""><br class="">Stay Safe,<br class=""><br class="">Greg<br class="">_______________________________________________<br class="">Zeek mailing list<br class=""><a href="mailto:zeek@zeek.org" class="">zeek@zeek.org</a><br class="">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek<br class=""></div></div></blockquote></div><br class=""></div></body></html>