Skip to content
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
src
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Bro::PF_RING

This plugin provides native PF_RING <http://www.ntop.org> support for Bro.

Bro-pkg Installation

Make sure you have the PF_RING library installed and then run:

bro-pkg install ntop/bro-pf_ring

Manual Installation

Follow PF_RING's instructions to get its kernel module, drivers and userspace libraries installed, then use the following commands to configure and build the plugin.

After building bro from the sources, change to the "bro-pf_ring" directory and run:

./configure --with-pfring=<PF_RING base directory> --bro-dist=<path to bro sources>
make && sudo make install

If everything built and installed correctly, you should see this:

bro -N Bro::PF_RING
Bro::PF_RING - Packet acquisition via PF_RING

Usage

Once installed, you can use PF_RING interfaces/ports by prefixing them with pf_ring:: on the command line. For example, to use PF_RING to monitor interface eth1:

bro -i pf_ring::eth1

To use it in production with multiple Bro processes, use a configuration similar to this in node.cfg (e.g. /usr/local/bro/etc/node.cfg):

[worker-1]
type=worker
host=localhost
interface=pf_ring::zc:eth1
lb_method=pf_ring
lb_procs=8
pin_cpus=0,1,2,3,4,5,6,7

Where lb_procs is the number of processes for load balancing (e.g. RSS) Now start the BroControl shell like:

broctl

The first-time, perform an initial installation of the BroControl configuration:

[BroControl] > install

Then start the Bro instances:

[BroControl] > start