[Zeek] zeek erros with zbalance_ipc

Justin Azoff justin at corelight.com
Fri Feb 21 15:20:14 PST 2020


On Fri, Feb 21, 2020 at 4:36 PM Tim Thompson <tim at tsqrd.net> wrote:

> Example:
> zbalance_ipc -i zc:eth1 -n 1 -m 1 -c 10 -g 1 -a (creates zc:10 at 0)
>
> [root at server opt]# zeek -i zc:10 at 0
> listening on zc:10 at 0
>

ah, you're using pf_ring through the libpcap wrapper and their wrapper is
doing something weird.  This problem should go away using
https://github.com/ntop/bro-pf_ring (and likely better performance too
since you won't need the wrapper)

That package may need a few updates to the cmake bits to compile properly
against zeek.. as well as the configure changes that make it possible to
build plugins without the zeek source code.

-- 
Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200221/7aa00647/attachment.html 


More information about the Zeek mailing list