PF_RING integration with Bro IDS post-install

Zeek
1

Hi,

Is there a way to enable PF_RING after a Bro IDS install? From what I saw, the Bro IDS documentation (https://www.bro.org/documentation/load-balancing.html) mentions the following pre-configuration to enable “pf_ring” pre-install but I wanted to know if it can be enabled post-install:

./configure --with-pcap=/opt/pfring
make
make install
2

Hello Dave,

Is there a way to enable PF_RING after a Bro IDS install? From what I saw,
the Bro IDS documentation (
https://www.bro.org/documentation/load-balancing.html) mentions the
following pre-configuration to enable "pf_ring" pre-install but I wanted to
know if it can be enabled post-install:

since Bro has to be compiled against the correct pfring libraries, this
sadly cannot be enabled without re-compiling and re-installing Bro.

Johanna

3

Use a bro plugin for pfring. No need to rebuild anything, just that plugin. Avoids libpcap.

https://github.com/bro/bro-plugins

4

Thank you.

What ‘configure’ option would I use to activate PF_RING if I installed pf_ring from the ntop repo and not a source package? I’m not sure if /opt/pfring is referencing a program or directory for it to see certain files.