[Bro-Dev] PCAP_PF_RING_CLUSTER_ID

[Seth Hall]

On Sep 15, 2011, at 9:52 PM, Robin Sommer wrote:

> With my 3 node cluster on FreeBSD, all the workers are started with
> PCAP_PF_RING_CLUSTER_ID=21. Where is the 21 coming from?

Heh, it's "bro" typed out on a phone number pad (276) represented as an 8bit int (wrapped around).  In other words, it's a fairly arbitrary number. :)

> And shouldn't
> we restrict this to systems that actually have PF_RING, like via a
> configure check?


I thought about doing that, but it seemed somewhat superfluous since those environment variables will only be used if the pf_ring libpcap wrapper is used.  It does seem like the right thing to do however.  We could just set the default value to "0" which will cause the environment variables to not be set but it seems like just causing more effort for users without much benefit.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/