[Bro-Dev] [JIRA] (BIT-1108) Add broctl option to set PF_RING cluster type

[Daniel Thayer (JIRA)]

Daniel Thayer created BIT-1108:
----------------------------------

             Summary: Add broctl option to set PF_RING cluster type
                 Key: BIT-1108
                 URL: https://bro-tracker.atlassian.net/browse/BIT-1108
             Project: Bro Issue Tracker
          Issue Type: Problem
          Components: BroControl
            Reporter: Daniel Thayer


Currently, when using PF_RING, broctl chooses the PF_RING
cluster type by setting the environment variable
PCAP_PF_RING_USE_CLUSTER_PER_FLOW.  In order to use a
different cluster type, we would need to set a different
environment variable (the PF_RING-aware libpcap does not
look at the actual value of the environment variable,
just whether the variable is defined or not), but there is
no option in broctl to do this.

To address this issue, a new broctl option PFRINGClusterType
can be added, then a user could change the value of this 
option to choose a different PF_RING cluster type (and the 
broctl pf_ring plugin would set the appropriate env. variable).  

The allowed values of this new broctl option would be:
"2-tuple", "4-tuple", "5-tuple", "tcp-5-tuple", "round-robin", 
or "6-tuple" (this one corresponds to the current
cluster type used by broctl).  By default, PFRINGClusterType 
would be set to "6-tuple".





--
This message was sent by Atlassian JIRA
(v6.2-OD-03#6206)