[Bro] Adding more bro workers

John Edwards jedwards2728 at gmail.com
Thu Nov 24 00:40:51 PST 2016

Hi all,

As i have a standalone bro worker at the moment i am wanting to branch out
and add more workers to the same link because of a high rate of packet loss.

the worker has the fibre card receiving the direct packet stream from our
TAP. When i upgrade to cluster mode i will be building two more systems,
one for the management/proxy/logger and then another worker.

As one worker will have the fibre card how does the worker number 2 or 3 or
4 in the future receive traffic to assist in processing the data feed? is
the load shared between workers that reside on the same subnet? as the feed
from the tap is just a passive fibre feed with no routing configured on it.

i hope each worker doesnt need to have a fibre card added into the same tap

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161124/b7682bad/attachment.html 

More information about the Bro mailing list