# Is there any implementation of Zeek/Bro with DPDK

**URL:** <https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832>\
**Category:** Zeek\
**Created:** [September 9, 2019, 11:12am UTC](https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832 "2019-09-09T11:12:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tarun\_Anand](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tarun\_Anand](https://community.zeek.org/u/Tarun_Anand)\
**Post date:** [September 9, 2019, 11:12am UTC](https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832/1 "2019-09-09T11:12:47Z")

</div>

Hello All

I would like to know if there is any prior/ ongoing work to implement Zeek on top of DPDK?

Thank You

Regards  
Tarun Anand

---

<div class="post-metadata">

**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\
**Post date:** [September 9, 2019, 12:44pm UTC](https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832/2 "2019-09-09T12:44:03Z")

</div>

Hi,

Might be other efforts out there, but I’ll note that I messed with this a (large number of) years ago on a small zeek cluster setup.

I didn’t find the results of a straightforward (e.g. rewriting a packet driver) implementation to be terribly encouraging: there was an existing implementation that supported ingest from Netmap and PF\_RING which did pretty well already, and the vast majority of zeek’s time was spent in script processing anyway. Thus I found the results to be somewhat … underwhelming, given the work / likely maintenance effort involved. A port of PacketBricks [1] might’ve been an interesting alternative approach, but was outside of the scope of the academic work I was doing at the time.

One thing I did have some success with was using DPDK to implement a very limited version of a sensor in C, and forwarding events from that to the larger zeek cluster through broccoli. That had utility in cases where a large percentage of the traffic was a specific type (and thus would take a well-known path through zeek script), and the number of events generated was relatively limited in relation to the traffic volume. This is, however, likely only suited for some pretty niche use-cases.

Good luck,  
Gilbert Clark

[1] [https://github.com/zeek/packet-bricks](https://github.com/zeek/packet-bricks)

---

<div class="post-metadata">

**Author:** ![Tarun\_Anand](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tarun\_Anand](https://community.zeek.org/u/Tarun_Anand)\
**Post date:** [September 9, 2019, 2:49pm UTC](https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832/3 "2019-09-09T14:49:07Z")

</div>

Thanks for the feedback!

Regards  
Tarun Anand

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/is-there-any-implementation-of-zeek-bro-with-dpdk/5832/4 "2022-05-06T15:46:45Z")

</div>