mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
0bc7d0905e
This has come up a few times and the motivation is mainly better "first timer" experience with Zeek. Concretely, if one wants to run a Zeek cluster with multiple workers and reasonable load balancing on Linux, AF_PACKET is a decent start. Without AF_PACKET support being built into Zeek, however, a new user's next experience is that of setting up a development environment in order to compile an external plugin (think compiler, kernel headers, zkg, ...). Only to get what could be termed basic functionality. This is using the ZEEK_INCLUDE_PLUGINS infrastructure. I've used the all upper case spelling of AF_PACKET in the help output because it seems everyone else references/writes it like that. I think we should also write it like that in the docs.
10 lines
446 B
Text
10 lines
446 B
Text
# @TEST-DOC: On Linux, test AF_PACKET support exists when enabled and the AF_Packet module is available in script land.
|
|
# @TEST-REQUIRES: ${SCRIPTS}/have-af-packet
|
|
# @TEST-EXEC: zeek -N Zeek::AF_Packet
|
|
# @TEST-EXEC: zeek -b %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
# Print some defaults for smoke checking.
|
|
print "buffer_size", AF_Packet::buffer_size;
|
|
print "enable_fanout", AF_Packet::enable_fanout;
|
|
print "fanout_mode", AF_Packet::fanout_mode;
|