[Bro] zbalance_ipc with multiple applications and Bro
michalpurzynski1 at gmail.com
Thu Feb 12 06:49:16 PST 2015
Thanks a lot - it seems that my own build of Bro has been linked to
the system libpcap instead of the pf_ring one. I'm fighting with that
now, will update this thread with observations, once I get it working.
On Thu, Feb 12, 2015 at 5:08 AM, Seth Hall <seth at icir.org> wrote:
>> On Feb 11, 2015, at 10:14 AM, Michał Purzyński <michalpurzynski1 at gmail.com> wrote:
>> Same for just zc:99 and not a surprise, Bro somehow needs to open
>> sub-interfaces 4-7.
>> Is it even supported?
> It is actually. :)
> In node.cfg, you would config a worker like this…
> In broctl.cfg, you’d set this…
> That should make it work. Unfortunately pfringfirstappinstance is a global variable for broctl, but it was easier when I was implementing it and I would generally expect people to be running the same or substantially similar zbalance_ipc configurations everywhere.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
More information about the Bro