[Bro] Using native PF_RING plugin with broctl

Jullian Remi remi.jullian at ssi.gouv.fr
Mon Feb 27 10:51:08 PST 2017

I installed bro using the following commands:

./configure --prefix=/usr/local/bro/
sudo make install

Then, bro is started using broctl install, followed by broctl start.

I have only one version of bro installed, the stable version 2.5
(Released Nov 16, 2016).

I was referring to the environment variables such as PATH, BROPATH or
CLUSTER_NODE, contained in ${PREFIX}/spool/worker-X/.env_vars, and
generated by the wrapper script ${PREFIX}/share/broctl/scripts/run-bro.

I forgot to mention that without using the native PF_RING plugin, I am
able to use PF_RING with the dedicated libpcap, such as explained here:

Therefore, I don't think that this issue is related to the pf_ring
network driver or something like that, but rather to bro or broctl that
does not set the right configuration to enable the plugin.

> How did you install bro?  Do you have more than one version of bro installed?
> What environment variables are you referring to?

More information about the Bro mailing list