# Zeek and myricom NICs
**URL:** https://community.zeek.org/t/zeek-and-myricom-nics/5833
**Category:** Zeek
**Created:** [September 11, 2019, 10:43am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833 "2019-09-11T10:43:13Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)
#### Post date: [September 11, 2019, 10:43am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/1 "2019-09-11T10:43:13Z")
Hi everybody,
quick question: is the bro-myricon plugin (by Seth) still necessary when using myricom nics with Zeek? I know with pf\_ring this is not the case anymore since bro can be directly linked to a modified pf\_ring libpcap and I was wondering if this is the case for myricom too.
Thanks,
Mauro
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [September 11, 2019, 1:36pm UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/2 "2019-09-11T13:36:22Z")
There are some advantages to using the Myricom plugin directly. Generally in my opinion I've been trying to avoid libpcap wrappers for quite a few years now because of various quality issues associated with several of them that I've experienced. There tends to be API functionality that you don't have an opportunity to take advantage of with a pcap wrapper too.
To some degree this is personal preference though.
.Seth
---
### Author:  [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)
#### Post date: [September 11, 2019, 1:52pm UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/3 "2019-09-11T13:52:19Z")
Hi Seth,
thanks for your prompt reply.
Looking at the myricom software API, I see that they have both a libpcap wrapper and more advanced functionalities in snf.h. Not all source code is open, however, and I am not sure which functionalities are implemented in the libpcap wrappers. In your plugin you are using snf\_open to open the NIC device. I would like to open a Myricom NIC with both aggregation and load\_balancing, i.e.
int flags = SNF\_F\_PSHARED;
flags |= SNF\_F\_AGGREGATE\_PORTMASK;
struct snf\_rss\_params rssp;
rssp.mode = SNF\_RSS\_FLAGS;
rssp.params.rss\_flags = SNF\_RSS\_IP | SNF\_RSS\_SRC\_PORT | SNF\_RSS\_DST\_PORT;
rc = snf\_open(portnum, 2, &rssp, dataring\_sz, flags, &hsnf);
but I am not sure this works. Did someone ever try it? Myricom documentation is a bit ambiguous on this point...
Mauro
-----Messaggio originale-----
---
### Author:  [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)
#### Post date: [September 11, 2019, 2:03pm UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/4 "2019-09-11T14:03:49Z")
A few years ago I found a bug in the snfv3 shipped libpcap where pcap\_next would return the previous packet when no packets were available instead of returning NULL. As far as I know it’s still not fixed.
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [September 11, 2019, 8:37pm UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/5 "2019-09-11T20:37:14Z")
Hah! I feel like I've seen little problems in every libpcap wrapper I've ever worked with. Never the same problem. 🙂
.Seth
---
### Author:  [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)
#### Post date: [September 12, 2019, 7:21am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/6 "2019-09-12T07:21:59Z")
Is anyone aware of other bugs in libpcap? I think this is valuable information to share to the community...
Mauro
-----Messaggio originale-----
---
### Author:  [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)
#### Post date: [September 12, 2019, 7:41am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/7 "2019-09-12T07:41:19Z")
Libpcap also makes (with some capture technologies) two calls per packet - one to get the packet and another to get the time stamp. That kills the performance.
When I was developing the early version of the myricom Zeek plugin, I didn’t really notice much, of any, performance improvement.
Btw you can use upstream libpcap and build it yourself against SNF. But why. Get the plugin. It’s easier.
If there are some missing pieces in the plugin I ought be able to help. We not longer have myricoms in production but I keep them in stage servers, for the community 😉
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [September 12, 2019, 10:47am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/8 "2019-09-12T10:47:45Z")
I wasn't referring to bugs in libpcap. It's the libpcap wrappers (which typically aren't libpcap, but rather reimplementations of some or all of the libpcap api).
.Seth
---
### Author:  [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)
#### Post date: [September 12, 2019, 11:57am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/9 "2019-09-12T11:57:00Z")
Sure, sorry I wrote too quickly. What I meant is if someone is aware of other bugs in other libpcap wrappers.
Mauro
-----Messaggio originale-----
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [September 16, 2019, 9:01am UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/10 "2019-09-16T09:01:59Z")
Ahh, it's a little hard to track these bugs because they tend to come and go without much documentation because vendors will just fix them in their SDKs and not make a big deal about it.
.Seth
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-and-myricom-nics/5833/11 "2022-05-06T15:46:45Z")