[Bro] Napatech's Libpcap on Bro 2.3.1

Kurt Grutzmacher grutz at jingojango.net
Tue Sep 9 17:21:21 PDT 2014


We have had good success with the nPule patch applied to 2.1 for direct
access but have not moved to the 2.3 branches yet.

https://github.com/nPulse/bro/tree/release/2.1-napatech


--
 Kurt Grutzmacher -=- grutz at jingojango.net

On Tue, Sep 9, 2014 at 3:05 PM, Gamarro, Estuardo <EGAMARRO at depaul.edu>
wrote:

> Hello,
>
>         I'm a new Bro user, and for the most part it has been easy to
> install/run Bro with Intel cards, but I hit a bump with Napatech libraries.
> Compiling Bro {2.3.0, 2.3.1} with  Napatech's libraries [1] completes
> without errors, but attempting to run bro or captures packets from command
> line results in full packet loss.  No obvious errors, it just runs without
> processing packets.  Oddly enough, Bro seemed to know how many packets it
> dropped...
>
>         Disabling nonblocking in PktSrc.cc [2] allowed Bro to finally
> capture packets, and as far as I can tell seems to work OK.  Has anybody
> else experienced this problem or found a better solution?
>
>
> E.J. Gamarro
>
>
> [1]
> Libpcap version 1.4
> NT Drivers 3gd 15.2 (Linux)
>
> [2]
> 528c528
> <       if ( pcap_setnonblock(pd, 1, tmp_errbuf) < 0 )
> ---
> >       if ( pcap_setnonblock(pd, 0, tmp_errbuf) < 0 )
>
>
>
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140909/195cd708/attachment.html 


More information about the Bro mailing list