[Zeek] Zeek and myricom NICs

[Seth Hall]

On 11 Sep 2019, at 6:43, Palumbo Mauro wrote:

>   quick question: is the bro-myricon plugin (by Seth) still necessary 
> when using myricom nics with Zeek?  I know with pf_ring this is not 
> the case anymore since bro can be directly linked to a modified 
> pf_ring libpcap and I was wondering if this is the case for myricom 
> too.

There are some advantages to using the Myricom plugin directly.  
Generally in my opinion I've been trying to avoid libpcap wrappers for 
quite a few years now because of various quality issues associated with 
several of them that I've experienced.  There tends to be API 
functionality that you don't have an opportunity to take advantage of 
with a pcap wrapper too.

To some degree this is personal preference though.

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com