Hello,
We need a way to load balance network traffic to the different Zeek processes and we found out these 2 solutions (https://github.com/J-Gras/zeek-af_packet-plugin and https://github.com/ntop/bro-pf_ring). It seems that AF packet is easier to use, but PF_RING gives more performance, according to this mail list ( http://mailman.icsi.berkeley.edu/pipermail/zeek/2017-February/011543.html ). The question is, is it worth?
AF packet is quite easy to compile into a .rpm file and even easier to use, but PF_RING seems to be more complicated. In addition, we are using Zeek 3.0.8 and according to PF Ring documentation ( https://www.ntop.org/guides/pf_ring/thirdparty/bro.html ) it seems that it may not work properly in some cases. We just want to know if someone has compared AF Packet vs. PF Ring and what were his conclusions.
Thanks!
Este correo y en su caso su(s) archivo(s) adjunto(s), proceden de OPEN CLOUD FACTORY, S.L. y se dirige exclusivamente a su destinatario, puede contener información privada o confidencial amparada por el secreto de empresa, y a la que sólo tiene el derecho de acceder el destinatario. Si no es Vd. el destinatario indicado, o la persona responsable de su entrega al mismo, deberá abstenerse de examinar su contenido y queda notificado de que la utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente mediante correo electrónico a esta misma dirección, y proceda a su destrucción segura. OPEN CLOUD FACTORY, S.L. es el responsable de tratamiento de los datos de carácter personal facilitados que se utilizarán con la finalidad de mantener comunicaciones con usted. Tiene la posibilidad de ejercitar los derechos de acceso, rectificación, limitación d
el tratamiento, supresión y portabilidad, mediante solicitud dirigida por escrito, acreditando su identidad a la dirección electrónica dpd@opencloudfactory.com. Puede consultar información adicional y detallada sobre nuestra política de protección de datos de nuestra web www.opencloudfactory.com.
This mail and the attached files (if any), are originated by OPEN CLOUD FACTORY, S.L. and are sent to the recipient exclusively. The email might contain private and / or confidential information protected by the business secrecy. The recipient is the only person that can access it. If you are not the recipient nor the person in charge of the information delivery to the recipient, please refrain from examinating its content. Additionally, you are hereby notified that the use, disclosure and / or copy of the content withouth permission is forbidden under applicable law. If you have received this email by mistake, please contact us to the same email address as soon as possible and remove it safely. OPEN CLOUD FACTORY, S.L. remains responsible for the processing of the given data and it will be used in order to communicate with you. To exercise your rights to access, modify, cancel and oppose the processing of your details, please contact dpd@opencloudfactory.com proving your identity. T
o read further information about our data protection policy, please visit our website www.opencloudfactory.com