[Bro] Using native PF_RING plugin with broctl

[James Lay]

On 2017-02-27 14:03, Azoff, Justin S wrote:
>> On Feb 27, 2017, at 2:47 PM, Seth Hall <seth at icir.org> wrote:
>> 
>> 
>>> On Feb 27, 2017, at 2:19 PM, Gary Faulkner <gfaulkner.nsm at gmail.com> 
>>> wrote:
>>> 
>>> When you built Bro did you also configure/make/make install the 
>>> pf_ring
>>> plugin? My recollection is that the plugins are not automatically 
>>> built
>>> when you build bro. They should be in the
>>> <path-to-bro-source>/aux/plugins/ in the source tree. They typically
>>> install into <path-to-bro>/lib/bro/plugins/.
>> 
>> Are there people out there that are using the pf_ring plugin to 
>> successfully load balance traffic?  I just checked the source to that 
>> plugin and I don't see where it sets up a load balanced ring. (I 
>> haven't worked on this plugin at all)
> 
> I can see from this thread that a number of people think they are
> using the plugin, but are not actually using it.
> 
> interface = eth0          # pf_ring libpcap wrapper
> interface = pf_ring::eth0 # native bro pf_ring plugin


I believe that's because I got the info from here:

https://www.bro.org/documentation/load-balancing.html

Maybe add info from 
https://www.bro.org/sphinx/components/bro-plugins/pf_ring/README.html to 
the above?  I will try out the native on next device reboot.

James