[Bro] PF_RING pfring_open() for Endace DAG

[Benjamin Wood]

On Tue, Mar 11, 2014 at 10:05 PM, Seth Hall <seth at icir.org> wrote:

> recently I added support for PF_Ring DNA to the BroControl plugin
>

Does that use pfring_open from the PF_RING API by chance? I was reading the
PF_RING User Guide, and noticed this:

As stated in the previous chapter, PF_RING 4.7 has a modular architecture.
In order to indicate to the library which module we are willing to use, it
is possible to prepend the module name to the device name, separated by a
colon (e.g. dna:dnaX at Y for the dna module, dag:dagX:Y for the dag module,
"multi:ethA at X;ethB at Y;ethC at Z" for the Link Aggregation module,
"dnacluster:A at X" for the Cluster consumer module).

Makes me think that if "dna:dnaX at Y" works then "dag:dagX:Y" should also
work. Anyways, my project is shifting gears now and I can't look into this
any further. I may come back to it in 6 months if there is still work to be
done here.

Thanks again,
Ben
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140312/4eee0bc6/attachment.html