# Bro PF RING

**URL:** <https://community.zeek.org/t/bro-pf-ring/3844>\
**Category:** Zeek\
**Created:** [September 22, 2015, 8:10pm UTC](https://community.zeek.org/t/bro-pf-ring/3844 "2015-09-22T20:10:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\
**Post date:** [September 22, 2015, 8:10pm UTC](https://community.zeek.org/t/bro-pf-ring/3844/1 "2015-09-22T20:10:34Z")

</div>

I am following the instructions on [bro.org](https://www.bro.org/sphinx/configuration/index.html#pf-ring-cluster-configuration) for the PF\_Ring install and have completed the below steps so far. I have a question about the next few steps:

How do i complete this?

…Refer to the documentation for your Linux distribution on how to load the pf\_ring module at boot time.

Does this basically mean i need to use the steps below on all worker nodes?

…You will need to install the PF\_RING library files and kernel module on all of the workers in your cluster.

I already downloaded bro and installed /configured it… is there a way to reconfigure bro without performing the below steps.

1. Download the Bro source code.

2. Configure and install Bro using the following commands:

_Steps Completed Thus Far on Ubuntu 14.04 LTS_  
cd /usr/src

sudo wget [http://sourceforge.net/projects/ntop/files/PF\_RING/PF\_RING-6.0.3.tar.gz](http://sourceforge.net/projects/ntop/files/PF_RING/PF_RING-6.0.3.tar.gz)  
sudo tar zxvf PF\_RING-6.0.3.tar.gz  
cd PF\_RING-6.0.3/userland/lib  
./configure --prefix=/opt/pfring  
make  
sudo make install

cd …/libpcap  
./configure --prefix=/opt/pfring  
make  
sudo make install

cd …/tcpdump-4.1.1  
./configure --prefix=/opt/pfring  
make  
sudo make install

cd …/…/kernel  
make  
sudo make install

sudo modprobe pf\_ring enable\_tx\_capture=0 min\_num\_slots=32768

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 22, 2015, 8:23pm UTC](https://community.zeek.org/t/bro-pf-ring/3844/2 "2015-09-22T20:23:03Z")

</div>

> I am following the instructions on bro.org for the PF\_Ring install and have completed the below steps so far. I have a question about the next few steps:

Looking good so far 🙂

> How do i complete this?  
> ...Refer to the documentation for your Linux distribution on how to load the pf\_ring module at boot time.

For ubuntu this should work, place

modprobe pf\_ring enable\_tx\_capture=0

in /etc/modules-load.d/pfring.conf

> Does this basically mean i need to use the steps below on all worker nodes?  
> ...You will need to install the PF\_RING library files and kernel module on all of the workers in your cluster.

Yes. If your manager does not have a capture interface you can skip the kernel steps on that machine, but you need to install all of the components on the workers.

> I already downloaded bro and installed /configured it.... is there a way to reconfigure bro without performing the below steps.  
> &nbsp;&nbsp;• Download the Bro source code.

You will need to configure bro using

./configure --with-pcap=/opt/pfring

in order for it to link against pf\_ring.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-pf-ring/3844/3 "2022-05-06T15:43:06Z")

</div>

Closed on May 6, 2022, 3:43pm UTC