[Bro-Dev] PF_RING cluster ID

Martin Holste mcholste at gmail.com
Wed Aug 31 09:14:25 PDT 2011


PF_RING's greatest feature is the ability to do per-flow clustering so
that many sniffers can run in parallel on their own CPU and each
receive a portion of the traffic which has been load-balanced.  Snort
and Suricata both support this, and we've come to rely on it as we
don't have access to hardware load balancing.  Is there a way to do
this in Bro?


More information about the bro-dev mailing list