[Zeek] pf_ring

[Michał Purzyński]

Why not give AF_Packet a try? We have an official zpkg package and a
plugin, with some instructions here
https://github.com/J-Gras/bro-af_packet-plugin

On Tue, Nov 5, 2019 at 8:05 PM venkatesh bandari <austin522 at gmail.com>
wrote:

> Hello Team,
>
> i installed zeek and using standard libcap
> ldd /opt/zeek/bin/zeek | grep pcap
>         libpcap.so.1 => /lib64/libpcap.so.1 (0x00007f1bad618000)
>
> iam seeing the box is dropping 40% packets.iam planning to have 2 more
> workers with pf_ring.Installed pf_ring
>
> in the link https://www.zeek.org/documentation/load-balancing.html
> it says zeek to point to below libcap.how doi change the to pfring sware
> libcap
>
> ldd /usr/local/bro/bin/bro | grep pcap
>         libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191106/7647a60a/attachment.html