[Bro] So before I upgrade (pf_ring revisit)
jlay at slave-tothe-box.net
Thu Aug 17 10:46:16 PDT 2017
On 2017-08-17 10:13, Seth Hall wrote:
> Sorry for the delay in answering!
> On 14 Aug 2017, at 14:07, James Lay wrote:
>> instead of interface? Or do I just use what's in the load-balancing
>> link? Additionally, what's the benefit of using one over the other
>> method? Thank you.
> I think you may want to use whats in the load-balancing link (the
> libpcap wrapper approach).
> I'm not sure of the state of the pf_ring plugin, especially since we
> removed everything in the bro-plugins repository. Robin emailed
> package maintainers there to try and get them to create Bro packages
> and I'm not sure the pf_ring one was moved over. The other problem is
> that the pf_ring plugin didn't/doesn't have a broctl plugin so you
> can't change any settings (such as the app_id). I *think* that load
> balancing works with it though, but I'm not sure offhand how you'd
> configure it correctly with broctl.
> Seth Hall * Corelight, Inc * www.corelight.com
Awesome...thanks Seth I'll stick with the load-balancing link for now.
More information about the Bro