AF_Packet Activation

Zeek
1

What is the proper way to activate the AF_Packet plugin? I believe its installed and configured correctly in nodes.cfg

$ bro -N Bro::AF_Packet
Bro::AF_Packet - Packet acquisition via AF_Packet (dynamic, version 1.0)

[lan]
type=worker
host=192.168.20.141
interface=af_packet::eth1
lb_method=custom
lb_procs=2
#af_packet_fanout_id=11
#af_packet_fanout_mode=FANOUT_HASH

But if I uncomment the options for fanout ID and mode I receive the errors:

Warning: ignoring unrecognized node config option ‘af_packet_fanout_id’ given for node ‘lan’
Warning: ignoring unrecognized node config option ‘af_packet_fanout_mode’ given for node ‘lan’

Should I be explicitly loading the init.bro script, and if so what would the syntax be to reference the bro/lib/bro/plugins/Bro_AF_Packet/scripts/directory?

-Dave

2

Hi Dave,

What is the proper way to activate the AF_Packet plugin? I believe its installed and configured correctly in nodes.cfg

in general, using the af_packet:: interface prefix activates the
AF_Packet plugin.

$ bro -N Bro::AF_Packet
Bro::AF_Packet - Packet acquisition via AF_Packet (dynamic, version 1.0)

[lan]
type=worker
host=192.168.20.141
interface=af_packet::eth1
lb_method=custom
lb_procs=2
#af_packet_fanout_id=11
#af_packet_fanout_mode=FANOUT_HASH

But if I uncomment the options for fanout ID and mode I receive the errors:

Warning: ignoring unrecognized node config option 'af_packet_fanout_id' given for node 'lan'
Warning: ignoring unrecognized node config option 'af_packet_fanout_mode' given for node ‘lan'

According to your bro -N output you are using the plugin in version 1.0.
The additional options have been added in version 1.1. In any case,
default values should be set automatically. If you want to set the
fanout mode manually, you need to use something like
"af_packet_fanout_mode=AF_Packet::FANOUT_HASH" (forgot the prefix in the
README, sorry).

Hope that helps,
Jan

3

Hi Dave,

The fanout_id option no longer causes a warning message but setting the fanout mode option as shown in the README file causes an error:

af_packet_fanout_mode=FANOUT_HASH

error in /data/bro/spool/tmp/check-config-lan-1/broctl-config.bro, line 19: unknown identifier FANOUT_HASH, at or near “FANOUT_HASH"

If you want to set the fanout mode manually, you need to use something like
"af_packet_fanout_mode=AF_Packet::FANOUT_HASH" (forgot the prefix in the
README, sorry).

:wink:

Best regards,
Jan

4

Thanks Jan! I misread your response and thought you were referring me to the README when you were actually pointing out the typo.