# Bro and pf\_ring

**URL:** <https://community.zeek.org/t/bro-and-pf-ring/3963>\
**Category:** Zeek\
**Created:** [January 7, 2016, 3:49pm UTC](https://community.zeek.org/t/bro-and-pf-ring/3963 "2016-01-07T15:49:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\
**Post date:** [January 7, 2016, 3:49pm UTC](https://community.zeek.org/t/bro-and-pf-ring/3963/1 "2016-01-07T15:49:54Z")

</div>

Hi all,  
i'm using bro with the pf\_ring driver in a cluster architecture as  
written in the link below

[https://www.bro.org/documentation/load-balancing.html](https://www.bro.org/documentation/load-balancing.html)

Now i've seen a plugin for bro able to provide native pf\_ring support

[https://github.com/bro/bro-plugins/tree/master/pf\_ring](https://github.com/bro/bro-plugins/tree/master/pf_ring)

Sorry for the lazy question, but which are the benefits of this plugin?  
Thanks

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@Jeff\_Lucovsky](https://community.zeek.org/u/Jeff_Lucovsky)\
**Post date:** [January 7, 2016, 8:30pm UTC](https://community.zeek.org/t/bro-and-pf-ring/3963/2 "2016-01-07T20:30:52Z")

</div>

Hi Vito,

If you’re using Bro 2.4 or later, the pf\_ring plugin is included in the stock Bro distribution. If that’s the case, then you do not need the plugin from github.

The plugin provides packet access when your setup includes PF\_RING _and_ you’re using Bro 2.4 or above. If you’re using Bro 2.3 or earlier, plugins don’t apply as the architecture didn’t support them.

When Bro introduced I/O sources with 2.4, the plugin architecture was created; Bro 2.3 didn’t use plugins for packet access. Check out the other Bro 2.4 plugins in /aux/bro-plugins.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [January 7, 2016, 9:15pm UTC](https://community.zeek.org/t/bro-and-pf-ring/3963/3 "2016-01-07T21:15:39Z")

</div>

You likely won’t see much of a benefit to using the plugin over using the libpcap wrapper honestly. Doing the single layer of indirection that is caused by the wrapper doesn’t add up to much overhead. Bro actually \*doing\* things causes most of the overhead.  
  
The other small thing to keep in mind is that I haven’t heard many experiences of people using the plugin so the “not widely used code” caveat applies. 🙂

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-and-pf-ring/3963/4 "2022-05-06T15:43:19Z")

</div>