pf_ring

Zeek
1

Hello Team,

i installed zeek and using standard libcap
ldd /opt/zeek/bin/zeek | grep pcap
libpcap.so.1 => /lib64/libpcap.so.1 (0x00007f1bad618000)

iam seeing the box is dropping 40% packets.iam planning to have 2 more workers with pf_ring.Installed pf_ring

in the link https://www.zeek.org/documentation/load-balancing.html
it says zeek to point to below libcap.how doi change the to pfring sware libcap

ldd /usr/local/bro/bin/bro | grep pcap
        libpcap.so.1 => /opt/pfring/lib/libpcap.so.1
2

Why not give AF_Packet a try? We have an official zpkg package and a plugin, with some instructions here
https://github.com/J-Gras/bro-af_packet-plugin