[Bro] So before I upgrade (pf_ring revisit)

[Seth Hall]

Sorry for the delay in answering!

On 14 Aug 2017, at 14:07, James Lay wrote:

> pf_ring::eth0
>
> instead of interface?  Or do I just use what's in the load-balancing
> link?  Additionally, what's the benefit of using one over the other
> method?  Thank you.

I think you may want to use whats in the load-balancing link (the 
libpcap wrapper approach).

I'm not sure of the state of the pf_ring plugin, especially since we 
removed everything in the bro-plugins repository.  Robin emailed package 
maintainers there to try and get them to create Bro packages and I'm not 
sure the pf_ring one was moved over.  The other problem is that the 
pf_ring plugin didn't/doesn't have a broctl plugin so you can't change 
any settings (such as the app_id).  I *think* that load balancing works 
with it though, but I'm not sure offhand how you'd configure it 
correctly with broctl.

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com