[Bro] Update on using PF_RING/TNAPI with Bro
sstattla at gmail.com
Wed Dec 15 14:11:18 PST 2010
> Why are you only running one bro process? You can setup a single node
> bro cluster and run multiple bro processes, each listening on one of
> eth0 at 1, eth0 at 2..
Yes, that's a great idea. But I'm not sure how Bro would handle
manager-proxy-worker communication between different RX_Queues instead
of different interfaces. Can't be as simple as writing eth0 at 1, etc. in
the cluster's node.cfg file. Maybe some changes to Bro code?
More information about the Bro