https://github.com/ntop/bro-pf_ring

Zeek (formerly Bro) plugin to capture packets through PF_RING
https://github.com/ntop/bro-pf_ring

Last synced: about 1 year ago
JSON representation

Zeek (formerly Bro) plugin to capture packets through PF_RING

• Host: GitHub
• URL: https://github.com/ntop/bro-pf_ring
• Owner: ntop
• License: other
• Created: 2017-07-17T21:35:45.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2020-04-20T10:53:27.000Z (over 6 years ago)
• Last Synced: 2025-04-08T04:51:23.434Z (over 1 year ago)
• Language: C++
• Homepage:
• Size: 16.6 KB
• Stars: 227
• Watchers: 7
• Forks: 12
• Open Issues: 2
• Metadata Files:
  • Readme: README
  • License: COPYING

Awesome Lists containing this project

README

          

Bro::PF_RING

============

This plugin provides native `PF_RING ` support for Bro.

Bro-pkg Installation

--------------------

Make sure you have the PF_RING library installed and then run:

    bro-pkg install ntop/bro-pf_ring

Manual Installation

-------------------

Follow PF_RING's instructions to get its kernel module, drivers and userspace libraries installed,

then use the following commands to configure and build the plugin.

After building bro from the sources, change to the "bro-pf_ring" directory and run:

    ./configure --with-pfring= --bro-dist=

    make && sudo make install

If everything built and installed correctly, you should see this:

    bro -N Bro::PF_RING

    Bro::PF_RING - Packet acquisition via PF_RING

Usage

-----

Once installed, you can use PF_RING interfaces/ports by prefixing them

with ``pf_ring::`` on the command line. For example, to use PF_RING to

monitor interface ``eth1``:

    bro -i pf_ring::eth1

To use it in production with multiple Bro processes, use a configuration 

similar to this in node.cfg (e.g. /usr/local/bro/etc/node.cfg):

    [worker-1]

    type=worker

    host=localhost

    interface=pf_ring::zc:eth1

    lb_method=pf_ring

    lb_procs=8

    pin_cpus=0,1,2,3,4,5,6,7

Where lb_procs is the number of processes for load balancing (e.g. RSS)

Now start the BroControl shell like:

    broctl

The first-time, perform an initial installation of the BroControl configuration:

    [BroControl] > install

Then start the Bro instances:

    [BroControl] > start