[Bro-Dev] [JIRA] (BIT-1108) Add broctl option to set PF_RING cluster type

[Seth Hall (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1108?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15001#comment-15001 ] 

Seth Hall commented on BIT-1108:
--------------------------------

Let's change the default to 4-tuple.

> Add broctl option to set PF_RING cluster type
> ---------------------------------------------
>
>                 Key: BIT-1108
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1108
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: BroControl
>            Reporter: Daniel Thayer
>
> Currently, when using PF_RING, broctl chooses the PF_RING
> cluster type by setting the environment variable
> PCAP_PF_RING_USE_CLUSTER_PER_FLOW.  In order to use a
> different cluster type, we would need to set a different
> environment variable (the PF_RING-aware libpcap does not
> look at the actual value of the environment variable,
> just whether the variable is defined or not), but there is
> no option in broctl to do this.
> To address this issue, a new broctl option PFRINGClusterType
> can be added, then a user could change the value of this 
> option to choose a different PF_RING cluster type (and the 
> broctl pf_ring plugin would set the appropriate env. variable).  
> The allowed values of this new broctl option would be:
> "2-tuple", "4-tuple", "5-tuple", "tcp-5-tuple", "round-robin", 
> or "6-tuple" (this one corresponds to the current
> cluster type used by broctl).  By default, PFRINGClusterType 
> would be set to "6-tuple".



--
This message was sent by Atlassian JIRA
(v6.2-OD-03#6206)