[Bro] Cluster+PF_RING doubt
seth at icir.org
Fri Feb 21 17:50:32 PST 2014
On Feb 21, 2014, at 6:08 PM, Martin Andreoni <martin at gta.ufrj.br> wrote:
This is definitely not right. You aren't defining how many processes you want to spread the traffic across (with lb_procs) and you have your other workers sniffing eth2 on their respective installations. PF_Ring spreads the traffic on a single host, but you're running 4 separate hosts (ignoring the fact that they're VMs. Couple of questions…
- Why VMs?
- Why aren't you just allocating more CPU cores to worker-5 and using pf_ring to balance the traffic across those cores?
If you allocated more CPU cores to worker-5, your config would look like this…
International Computer Science Institute
(Bro) because everyone has a network
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140221/c5482f9a/attachment.bin
More information about the Bro