Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
I believe the conditions for it to work depend a little bit too much on libpcap. I would suggest removing it in favor of a separate af_packet plugin, but do leave the pcap buffer patch in place.
@Robin: You are right. I have already started writing the AF_PACKET plugin for Bro and I can update my broctl patch as well.
Ok, I'l remove. Looking forward to the plugin!
Yes, please remove the change and just leave the configurable buffer if you can.
Going through libpcap which might or might not work taught us to write a packet source plugin instead, which won't depend on anything and less code is always nice.
Always nice to learn something.
This has already been removed for a while, closing.