Hello Zeek Community,
I know there is a penchant for those in this community to recommend
af_packet over pf_ring - which is fine, even so, I just want to say
using pf_ring, especially if you are an EDU, makes perfect sense and it
is super high performance.
I have set up Zeek monitoring on a single Zeek-in-a-box using Fiberblaze
FGPA and pf_ring. Zeek is easily keeping up with bursts of traffic up
to 12 Gbps with very minimal packet loss, less than 1% if I am not
utilizing Dumbno to shunt traffic, using Dumbno to shunt traffic causes
Zeek to report increased packet loss which makes perfect sense.
I recommend pf_ring for certain, and if you want to utilize a less
expensive Intel FGPA; pf_ring ZC.