[Bro] PF_RING pfring_open() for Endace DAG
ben.bt.wood at gmail.com
Wed Mar 12 07:06:08 PDT 2014
On Tue, Mar 11, 2014 at 10:05 PM, Seth Hall <seth at icir.org> wrote:
> recently I added support for PF_Ring DNA to the BroControl plugin
Does that use pfring_open from the PF_RING API by chance? I was reading the
PF_RING User Guide, and noticed this:
As stated in the previous chapter, PF_RING 4.7 has a modular architecture.
In order to indicate to the library which module we are willing to use, it
is possible to prepend the module name to the device name, separated by a
colon (e.g. dna:dnaX at Y for the dna module, dag:dagX:Y for the dag module,
"multi:ethA at X;ethB at Y;ethC at Z" for the Link Aggregation module,
"dnacluster:A at X" for the Cluster consumer module).
Makes me think that if "dna:dnaX at Y" works then "dag:dagX:Y" should also
work. Anyways, my project is shifting gears now and I can't look into this
any further. I may come back to it in 6 months if there is still work to be
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro