[Bro] So before I upgrade (pf_ring revisit)

[James Lay]

On 2017-08-17 10:13, Seth Hall wrote:
> Sorry for the delay in answering!
> 
> On 14 Aug 2017, at 14:07, James Lay wrote:
> 
>> pf_ring::eth0
>> 
>> instead of interface?  Or do I just use what's in the load-balancing
>> link?  Additionally, what's the benefit of using one over the other
>> method?  Thank you.
> 
> I think you may want to use whats in the load-balancing link (the
> libpcap wrapper approach).
> 
> I'm not sure of the state of the pf_ring plugin, especially since we
> removed everything in the bro-plugins repository.  Robin emailed
> package maintainers there to try and get them to create Bro packages
> and I'm not sure the pf_ring one was moved over.  The other problem is
> that the pf_ring plugin didn't/doesn't have a broctl plugin so you
> can't change any settings (such as the app_id).  I *think* that load
> balancing works with it though, but I'm not sure offhand how you'd
> configure it correctly with broctl.
> 
>   .Seth
> 
> --
> Seth Hall * Corelight, Inc * www.corelight.com

Awesome...thanks Seth I'll stick with the load-balancing link for now.

James