# Anyone using PF\_RING ZC with Bro yet? **URL:** \ **Category:** Zeek\ **Created:** [August 14, 2014, 3:33am UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224 "2014-08-14T03:33:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Gary\_Faulkner1](https://avatars.discourse-cdn.com/v4/letter/g/aeb1de/32.png) [@Gary\_Faulkner1](https://community.zeek.org/u/Gary_Faulkner1)\ **Post date:** [August 14, 2014, 3:33am UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224/1 "2014-08-14T03:33:33Z")
Hello, I have a couple new machines to set up and I am curious if anyone has upgraded from PF\_RING DNA + Libzero to PF\_RING ZC for use with Bro and what your experience has been? Is it safe or preferred to upgrade to ZC or to stick with the DNA/Libzero approach at this time? Regards, Gary ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 14, 2014, 3:42am UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224/2 "2014-08-14T03:42:34Z")
The PF\_Ring plugin in 2.3 should support ZC interfaces from the ZC traffic balancing tool they provide. One problem with it though is that the new ZC tool only support balancing the traffic to a single tool unlike the DNA load balancing tool which can load balance traffic multiple times out to different tools.   .Seth ---
**Author:** ![Gary\_Faulkner1](https://avatars.discourse-cdn.com/v4/letter/g/aeb1de/32.png) [@Gary\_Faulkner1](https://community.zeek.org/u/Gary_Faulkner1)\ **Post date:** [August 14, 2014, 4:14am UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224/3 "2014-08-14T04:14:25Z")
Seth, Thanks for the reply. I remembered you commenting on that and asked Alfredo from NTOP if it was supported yet and he indicated that you can actually do the multiple app thing now. He also mentioned that the daemon mode option isn't implemented within the new script. For example I asked about doing something like this, but in ZC: pfdnacluster\_master -i dna0,dna1 -d -n 12,1 -c 21 Alfredo indicated I should be able to get similar results with the new script like this (excepting no built in -d mode): zbalance\_ipc -i zc:ethX,zc:ethY -n 12,1 -m 1 -c 21 That said I also seem to recall someone else on the bro list having some other issues such as with jumbo frames or missing packets, but don't know if those ever got resolved. ZC is initially tempting because you only need the one ZC license instead of separate licenses for the DNA driver and Libzero, plus not having to go back for ZC later, but that's only helpful if it is working well for people. Regards, Gary ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 14, 2014, 5:03am UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224/4 "2014-08-14T05:03:30Z")
Ah nice! It's been several months since I've looked at this. I think that to get this config working in Bro you should be able to use lb\_method=pf\_ring with interface=zc:21 (in Bro 2.3).   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/anyone-using-pf-ring-zc-with-bro-yet/3224/5 "2022-05-06T15:41:59Z")