[Bro] Cluster+PF_RING doubt

Seth Hall seth at icir.org
Fri Feb 21 17:50:32 PST 2014

On Feb 21, 2014, at 6:08 PM, Martin Andreoni <martin at gta.ufrj.br> wrote:

> [worker-4]
> type=worker
> host=
> interface=eth2
> lb_method=pf_ring
> [worker-5]
> type=worker
> host=
> interface=eth4
> lb_method=pf_ring

This is definitely not right.  You aren't defining how many processes you want to spread the traffic across (with lb_procs) and you have your other workers sniffing eth2 on their respective installations.  PF_Ring spreads the traffic on a single host, but you're running 4 separate hosts (ignoring the fact that they're VMs.  Couple of questions…

  - Why VMs?
  - Why aren't you just allocating more CPU cores to worker-5 and using pf_ring to balance the traffic across those cores?
If you allocated more CPU cores to worker-5, your config would look like this…



Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140221/c5482f9a/attachment.bin 

More information about the Bro mailing list