PF_Ring plugin Issue

Zeek
1

Hi guys,

Recently we have been trying different ways to balance the traffic between workers. The thing is that we tried installing the pf_ring plugin, and we installed right. We changed the node.cfg interface to pf_ring::X and it worked but now that we uninstalled the plugin we are having an issue that its like the packets are still going to the pf_ring::X interface but like the plugin is not installed anymore if we put the pf_ring::X interface in the node.cfg, Zeek workers don’t start. So, now the only way that Zeek workers start is with the normal interface name but zeek don’t see any traffic in this interface.

So it seems that we did something wrong when we uninstalled the plugin. Can someone help me to solve this issue please?

Thank you all.

Best Regards!

2

If you installed pf_ring and then built zeek, it's possible that you
ended up compiling zeek against the libpcap from pf_ring, instead of
the standard libpcap. Try a

    ldd $(which zeek)

and see which libpcap it is using.

In any case, you should try the af_packet plugin.

3

Is there any part of pf_ring functionality that you cannot find in the af_packet capture mechanism?