[Zeek] Zeek Vs. FreeBSD

[Michael Shirk]

Some questions to get started:
Which version of FreeBSD are you using?
Which network card are you using?

The biggest issue is parity between the netmap and FreeBSD source
trees, you really need to run FreeBSD-CURRENT to ensure you have all
of the latest changes. There were some issues in the past that
affected even Intel network cards from working correctly, so the types
of cards you are using are very important.

I pushed to get the netmap tools added to the source tree, so you can
build "lb" from the following location and use it:
/usr/src/tools/tools/netmap/lb.c

I am updating a FreeBSD system to see if this still builds correctly
as I have not used LB in a while.

On Thu, May 7, 2020 at 12:32 PM Anthony Arnaud
<antho.arnaudisce at gmail.com> wrote:
>
> Hi All,
> I tried to install Zeek on my FreeBSD server with netmap support.
> But VirtIO Ethernet driver is not working properly, there are performance problems that should be solved in the latest Netmap release, ref to:
>
> https://reviews.freebsd.org/D17916
>
> Unfortunately the bro-netmap plugin does not work with that.
> It seems that Zeek is unusable in FreeBSD env, the developments of the bro-netmap plugin are closed and it is impossible to parallelize network traffic on multiple zeek workers.
> Does anyone know if updates are currently planned?
> Or if someone using this plugin with the Netmap last version?
> Or, finally, are there other BSD loadbalancing solutions ?
> Thank y'all
>
> Anthon
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 
Michael Shirk
Daemon Security, Inc.
https://www.daemon-security.com