[Bro-Dev] PF_RING cluster ID

Seth Hall seth at icir.org
Wed Aug 31 10:47:51 PDT 2011


On Aug 31, 2011, at 12:54 PM, Gregor Maier wrote:

> I think it doesn't work like that :-(
> It appears that PF_RINGs clustering doesn't use virtual interfaces for its clustering.

Arg.  Well that's annoying.  

> a) directly: add a new PktSrc() that uses the PF_RING API directly and add the command line argument to specify the clustering information. BroControl will likely need to be updated as well. If somebody does that, than the same framework can probably be used for Endace's load-balancing packet capture as well.

I keep thinking that we should something along these lines eventually.  I'd like to support the upcoming FreeBSD netmap API directly as well since it seems like there are some performance benefits to that over using their libpcap wrapper.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list