[Bro] Adding more bro workers

Zeolla@GMail.com zeolla at gmail.com
Thu Nov 24 02:52:30 PST 2016

In my scenario we use a switch (specifically an arista 7150 with a Z
licence) to do symmetric load balancing to a cluster of bro sensors.  That
requires that all of my sensors have the appropriate NICs (myricoms for me).

Check out what the architecture documentation refers to as the frontend.


On Thu, Nov 24, 2016, 03:49 John Edwards <jedwards2728 at gmail.com> wrote:

> Hi all,
> As i have a standalone bro worker at the moment i am wanting to branch out
> and add more workers to the same link because of a high rate of packet loss.
> the worker has the fibre card receiving the direct packet stream from our
> TAP. When i upgrade to cluster mode i will be building two more systems,
> one for the management/proxy/logger and then another worker.
> As one worker will have the fibre card how does the worker number 2 or 3
> or 4 in the future receive traffic to assist in processing the data feed?
> is the load shared between workers that reside on the same subnet? as the
> feed from the tap is just a passive fibre feed with no routing configured
> on it.
> i hope each worker doesnt need to have a fibre card added into the same
> tap point.
> Cheers
> John
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



Sent from my mobile device
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161124/41219aa9/attachment.html 

More information about the Bro mailing list