[Bro-Dev] PF_RING cluster ID

Martin Holste mcholste at gmail.com
Wed Aug 31 10:48:49 PDT 2011


The PF_RING API is incredibly simple.  I bet you could get this
working in just a few hours, and that would be an enormous win for the
community.

On Wed, Aug 31, 2011 at 12:47 PM, Seth Hall <seth at icir.org> wrote:
>
> On Aug 31, 2011, at 12:54 PM, Gregor Maier wrote:
>
>> I think it doesn't work like that :-(
>> It appears that PF_RINGs clustering doesn't use virtual interfaces for its clustering.
>
> Arg.  Well that's annoying.
>
>> a) directly: add a new PktSrc() that uses the PF_RING API directly and add the command line argument to specify the clustering information. BroControl will likely need to be updated as well. If somebody does that, than the same framework can probably be used for Endace's load-balancing packet capture as well.
>
> I keep thinking that we should something along these lines eventually.  I'd like to support the upcoming FreeBSD netmap API directly as well since it seems like there are some performance benefits to that over using their libpcap wrapper.
>
>  .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro-ids.org/
>
>



More information about the bro-dev mailing list