Napatech's Libpcap on Bro 2.3.1

Zeek
1

Hello,

  I'm a new Bro user, and for the most part it has been easy to
install/run Bro with Intel cards, but I hit a bump with Napatech libraries.
Compiling Bro {2.3.0, 2.3.1} with Napatech's libraries [1] completes
without errors, but attempting to run bro or captures packets from command
line results in full packet loss. No obvious errors, it just runs without
processing packets. Oddly enough, Bro seemed to know how many packets it
dropped...

  Disabling nonblocking in PktSrc.cc [2] allowed Bro to finally
capture packets, and as far as I can tell seems to work OK. Has anybody
else experienced this problem or found a better solution?

E.J. Gamarro

[1]
Libpcap version 1.4
NT Drivers 3gd 15.2 (Linux)

[2]
528c528
< if ( pcap_setnonblock(pd, 1, tmp_errbuf) < 0 )

2

We have had good success with the nPule patch applied to 2.1 for direct access but have not moved to the 2.3 branches yet.

https://github.com/nPulse/bro/tree/release/2.1-napatech