[Bro-Dev] Scaling out bro cluster communication

Matthias Vallentin vallentin at icir.org
Fri Feb 10 08:49:56 PST 2017

> What I want to make possible is client side load balancing and
> failover for worker -> manager/datanode communication.

This is an important part of future Bro deployments. 

Before delving into script code, I would like to get a better
understanding of the underlying concepts and communication patterns.
Once we have a clear picture what workloads we need to support, we can
make architectural choices. Finally, the API falls out at the end.

Concretely: can you describe (without Bro script code) what "client-side
load-balancing and failover" means? Who is the client and what state
needs to be resilient to failure? I don't think we have a working
definition of "data node" either. My hunch is that they are involved in
MapReduce computation and perhaps represent the reducers, but I'm not


More information about the bro-dev mailing list