[Bro] Cluster setup

hiren panchasara hiren.panchasara at gmail.com
Thu Oct 31 12:20:35 PDT 2013

On Thu, Oct 31, 2013 at 9:51 AM, Seth Hall <seth at icir.org> wrote:
> On Oct 31, 2013, at 12:33 PM, hiren panchasara <hiren.panchasara at gmail.com> wrote:
>> I somehow cannot direct a queue's traffic to a specific worker?
> You already said you had 8 queues on your NIC though?  I guess I assumed you had something like PF_Ring configured to split your traffic to multiple processes.

Right. So (afaik) in FreeBSD we do not have PF_RING like functionality
where there is an PF_RING application sdk and applications can choose
which queue it wants to listen to. Intel NIC (that I am using)
definitely can distribute traffic in 8 queues it has but question for
me is, how do I distribute it to the application/workers.

I also have a larger question here though.

How do people usually do something that I want to do: Have a box tap
continuous traffic on a 10G card and let workers parse/interpret it
(via bro).

Do they have PF_RING setup which blindly ports queue:1 traffic to
worker:1 and bro (using PF_RING's sdk) will do the parsing?

Simple aim here is load-distribution.

Thanks a lot of tolerating my (possibly) stupid questions :-)


More information about the Bro mailing list