[Bro-Dev] #943: PF_Ring plugin to support load balancing while sniffing multiple interfaces

[Bro Tracker]

#943: PF_Ring plugin to support load balancing while sniffing multiple interfaces
------------------------+------------------------
 Reporter:  seth        |      Owner:  dnthayer
     Type:  Problem     |     Status:  new
 Priority:  Medium      |  Milestone:  Bro2.2
Component:  BroControl  |    Version:  git/master
 Keywords:              |
------------------------+------------------------
 As reported by Jordi Ros-Giralt, if you want to sniff two interfaces on
 the same host and load balance each interface across several workers there
 are problems where all of the traffic is not monitored because it's all
 put into the same pf_ring cluster id.

 I suspect we need to do two things:

  - Make cluster_id settable in the worker config as an override for the
 global option.

  - Make the plugin watch for multiple load balancing rings on the same
 host (is this possible with the current plugin architecture?) and adapt by
 making the second load balancing ring use the global value +1.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/943>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker