[Bro] PF_RING Clustering Problem
seth at icir.org
Wed Jun 19 09:06:57 PDT 2013
On Jun 19, 2013, at 1:34 AM, Jeff Scaparra <jeff at scaparra.com> wrote:
> I followed this howto http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html however I am finding bro is now reporting 4 of everything so the load balancing isn't working. How can I verify PF_RING is load balancing or what could I be missing? Is there a better document I should be looking at?
Those directions are outdated. Instead of configuring separate workers you should configure a single worker per interface you are sniffing like this…
That will automatically enable the pf_ring load balancing and start up four processes that the traffic on eth0 is load balanced across.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro