[Bro] Bro and PF_RING Cluster ID
mcholste at gmail.com
Tue Jul 31 19:32:23 PDT 2012
Correct on the max of 8 workers:
kernel/linux/pf_ring.h:#define CLUSTER_LEN 8
You can up that to something higher and recompile the kernel module if
you have more cores.
On Tue, Jul 31, 2012 at 5:36 PM, Robert Rotsted <rrotsted at pdx.edu> wrote:
> Hi all,
> I'm running a clustered Bro instance with workers capturing traffic on
> three PF_RING enabled e1000e interfaces.
> While looking in /proc/net/pf_ring/ I noticed that all of my Bro
> workers belong to cluster id 21. Is it possible (or desirable) in Bro
> to create a PF_RING cluster id per capture interface?
> I read that PF_RING allows a maximum of eight workers per cluster id,
> is this still true?
> Bro mailing list
> bro at bro-ids.org
More information about the Bro