[Bro-Dev] #943: PF_Ring plugin to support load balancing while sniffing multiple interfaces

William Jones jones at tacc.utexas.edu
Fri Apr 26 10:08:40 PDT 2013


I read from multiple interfaces per worker,  a consequence of of using taps to monitor a two port 10 GigE LACP pair.  The net

I can't use PF_ring sense bro does not synchronizes the start up of each worker.   Sterilized  the startup it would allow a single work to get same has function for each interface.  The a good chanes that a worker could end up with hash function in pf_Ring that are not the same.  

Here is what my worker config look like:


#
[worker-1]
type=worker
host=ids.tacc.utexas.edu.
interface=p1p1.667 -ip1p2.667 -ip2p1.667 -ip2p2.667 
aux_scripts=q1of8

#
[worker-2]
type=worker
host=ids.tacc.utexas.edu.
interface=p1p1.667 -ip1p2.667 -ip2p1.667 -ip2p2.667 
aux_scripts=q2of8


I partition the ip space across 8 workers using pcap fitlers.

I use PF_Ring if bro supported for multiple interfaces.


  
-----Original Message-----
From: bro-dev-bounces at bro.org [mailto:bro-dev-bounces at bro.org] On Behalf Of Bro Tracker
Sent: Thursday, April 25, 2013 2:42 PM
To: seth at icir.org; dnthayer at ncsa.illinois.edu
Cc: bro-dev at bro.org
Subject: Re: [Bro-Dev] #943: PF_Ring plugin to support load balancing while sniffing multiple interfaces

#943: PF_Ring plugin to support load balancing while sniffing multiple interfaces
----------------------------+------------------------
  Reporter:  seth           |      Owner:  dnthayer
      Type:  Merge Request  |     Status:  new
  Priority:  High           |  Milestone:  Bro2.2
 Component:  BroControl     |    Version:  git/master
Resolution:                 |   Keywords:
----------------------------+------------------------

Comment (by dnthayer):

 Replying to [comment:4 seth]:
 > From visually inspecting it, it seems ok to me.  Did you test it enough  to see if the cluster id's are set correctly?  I'd say we can go ahead and  merge it if you did.

 Yes, I tested it.  I was just wondering if we need anything else, or if it  is done for now.

--
Ticket URL: <http://tracker.bro.org/bro/ticket/943#comment:5>
Bro Tracker <http://tracker.bro.org/bro> Bro Issue Tracker

_______________________________________________
bro-dev mailing list
bro-dev at bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev



More information about the bro-dev mailing list