To anybody integrating PF_RING with Zeek - in some cases flags are necessary for Zeek’s configuration to work properly:
LDFLAGS=“-lpfring -lpcap” ./configure --with-pcap={ path_to_lib/libpcap }
FYI this info is not in the zeek docs, but it is in ntop’s docs:
https://www.ntop.org/guides/pf_ring/thirdparty/bro.html
Best,
Brittany Donowho
US Naval Research Laboratory