# Bro and PF\_Ring **URL:** \ **Category:** Zeek\ **Created:** [July 18, 2016, 3:43pm UTC](https://community.zeek.org/t/bro-and-pf-ring/4249 "2016-07-18T15:43:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Obdnanr\_smith](https://avatars.discourse-cdn.com/v4/letter/o/9e8a1a/32.png) [@Obdnanr\_smith](https://community.zeek.org/u/Obdnanr_smith)\ **Post date:** [July 18, 2016, 3:43pm UTC](https://community.zeek.org/t/bro-and-pf-ring/4249/1 "2016-07-18T15:43:32Z")
I’ve followed the steps to get Bro to use pf\_ring and it even shows that it’s using the pf\_ring/lib, but as soon as I install from my manager it reverts back to libpcap. Any ideas? ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [July 18, 2016, 8:02pm UTC](https://community.zeek.org/t/bro-and-pf-ring/4249/2 "2016-07-18T20:02:39Z")
It sounds like you are building and installing bro on the worker nodes a well as on the manager nodes. You only need to install bro on the manager node. broctl copies the bro installation to each worker node for you. The process for using pf\_ring on a bro cluster would be: 1) install pf\_ring kernel module and libraries on each worker 2) install pf\_ring libraries on the manager - You can install the kernel modules if you wanted to, but nothing will use them. 3) install bro on the manager If you are missing the pf\_ring libraries on the manager that will cause the manager binary to not be linked against pf\_ring. ---
**Author:** ![Clark\_Gaylord](https://avatars.discourse-cdn.com/v4/letter/c/e47774/32.png) [@Clark\_Gaylord](https://community.zeek.org/u/Clark_Gaylord)\ **Post date:** [July 19, 2016, 1:54pm UTC](https://community.zeek.org/t/bro-and-pf-ring/4249/3 "2016-07-19T13:54:29Z")
> It sounds like you are building and installing bro on the worker nodes a well as on the manager nodes. You only need to install bro on the manager node. broctl copies the bro installation to each worker node for you. > … > 3) install bro on the manager > > If you are missing the pf\_ring libraries on the manager that will cause the manager binary to not be linked against pf\_ring. Making sure I follow you: And hence the binary distributed to the workers by the manager will not pick up those libraries, even though they do exist on the worker? ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-and-pf-ring/4249/4 "2022-05-06T15:43:51Z")