[Bro] Cluster setup
hiren.panchasara at gmail.com
Thu Oct 31 12:20:35 PDT 2013
On Thu, Oct 31, 2013 at 9:51 AM, Seth Hall <seth at icir.org> wrote:
> On Oct 31, 2013, at 12:33 PM, hiren panchasara <hiren.panchasara at gmail.com> wrote:
>> I somehow cannot direct a queue's traffic to a specific worker?
> You already said you had 8 queues on your NIC though? I guess I assumed you had something like PF_Ring configured to split your traffic to multiple processes.
Right. So (afaik) in FreeBSD we do not have PF_RING like functionality
where there is an PF_RING application sdk and applications can choose
which queue it wants to listen to. Intel NIC (that I am using)
definitely can distribute traffic in 8 queues it has but question for
me is, how do I distribute it to the application/workers.
I also have a larger question here though.
How do people usually do something that I want to do: Have a box tap
continuous traffic on a 10G card and let workers parse/interpret it
Do they have PF_RING setup which blindly ports queue:1 traffic to
worker:1 and bro (using PF_RING's sdk) will do the parsing?
Simple aim here is load-distribution.
Thanks a lot of tolerating my (possibly) stupid questions :-)
More information about the Bro