mcholste at gmail.com
Mon Sep 19 06:54:20 PDT 2011
But a cluster_id of 0 indicates the cluster is not being used, which
it is, so it must be a positive integer. To keep it as simple as
possible, I guess I'd go with 1, but since there may be other clusters
running on the same system, there is value in picking a pseudo-random
number like 21, as 1 is probably more common for someone to choose for
the reason above. 21 has some "Bro" meaning. For instance, a system
with Suricata will use cluster_id 99 by default. Also, I would argue
that if you've installed PF_RING, you are "initiated," at least to
some extent. I say this because you have to go out of your way to
install it--it's not in any standard Linux distro.
On Sun, Sep 18, 2011 at 11:27 PM, Robin Sommer <robin at icir.org> wrote:
> On Thu, Sep 15, 2011 at 22:19 -0400, you wrote:
>> Heh, it's "bro" typed out on a phone number pad (276) represented as
>> an 8bit int (wrapped around). In other words, it's a fairly arbitrary
>> number. :)
> I see. :) But let's then please use something like 0 or -1 to indicate
> that it actually doesn't matter. Arbitrary values can be quite
> confusing for the non-initiated.
>> I thought about doing that, but it seemed somewhat superfluous since
>> those environment variables will only be used if the pf_ring libpcap
>> wrapper is used. It does seem like the right thing to do however.
> Yeah, for the same reason as above: I bet that otherwise somebody will
> scratch his head at some point to understand what effect
> PCAP_PF_RING_CLUSTER_ID has on his FreeBSD box.
> Cc'in the tracker. Tasks are:
> - If system doesn't have PF_RING support, don't set environment
> - If system has PF_RING support, set ID to a default that
> indicates "not set".
> @component: BroControl
> @version: git/master
> @type: Task
> @milestone: Bro1.6
> @keywords: beta
> Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
> ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
> bro-dev mailing list
> bro-dev at bro-ids.org
More information about the bro-dev