[Bro-Dev] [JIRA] (BIT-1363) Clustered AF_PACKET support

[Jon Siwek (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=20235#comment-20235 ] 

Jon Siwek commented on BIT-1363:
--------------------------------

{quote}
I am not sure we can do this easily, because we need something that makes sure that the same flows always go to the same bro workers... this seems like it might be a job for packet-bricks or similar and not for Bro.
{quote}

I thought the PACKET_FANOUT_HASH socket option helps there?

> Clustered AF_PACKET support
> ---------------------------
>
>                 Key: BIT-1363
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1363
>             Project: Bro Issue Tracker
>          Issue Type: New Feature
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: Michal Purzynski
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.



--
This message was sent by Atlassian JIRA
(v6.4-OD-16-006#64014)