[Bro] Bro 2.0 packets dropped
Machiel van Veen
mvv at sentia.nl
Fri Feb 10 00:12:07 PST 2012
On Thursday 09 February 2012 14:55:07 Seth Hall wrote:
> On Feb 9, 2012, at 2:41 AM, Machiel van Veen wrote:
> > There have been no alerts regarding packet loss either. Thanks for you
> > support on this issue, back to clustering for me ;)
> Great to hear! Broadcom nics have the weirdest problems.
> Are you doing network based clustering (multiple physical hosts)?
I'm looking to run one physical host for now and add a second with several
workers later. However load balancing has not worked yet, the module and
driver are loaded and pfcount shows traffic but Bro reports everything triple,
no load balancing.
Is there any configuration apart from configuring the manager, proxy and
workers in node.cfg done in Bro to get this working?
As I understood there should not be, as long as you link to the pf_ring
enabled libpcap it should work when pf_ring is active.
More information about the Bro