[Bro] Bro and PF_RING Cluster ID

Martin Holste mcholste at gmail.com
Tue Jul 31 19:32:23 PDT 2012


Correct on the max of 8 workers:

kernel/linux/pf_ring.h:#define CLUSTER_LEN       8

You can up that to something higher and recompile the kernel module if
you have more cores.

On Tue, Jul 31, 2012 at 5:36 PM, Robert Rotsted <rrotsted at pdx.edu> wrote:
> Hi all,
>
> I'm running a clustered Bro instance with workers capturing traffic on
> three PF_RING enabled e1000e interfaces.
>
> While looking in /proc/net/pf_ring/ I noticed that all of my Bro
> workers belong to cluster id 21. Is it possible (or desirable) in Bro
> to create a PF_RING cluster id per capture interface?
>
> I read that PF_RING allows a maximum of eight workers per cluster id,
> is this still true?
>
> Best,
>
> Bob
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



More information about the Bro mailing list