[Bro] Update on using PF_RING/TNAPI with Bro

Sunjeet Singh sstattla at gmail.com
Wed Dec 15 14:11:18 PST 2010


> Why are you only running one bro process?  You can setup a single node
> bro cluster and run multiple bro processes, each listening on one of
> eth0 at 1, eth0 at 2..
>
Yes, that's a great idea. But I'm not sure how Bro would handle 
manager-proxy-worker communication between different RX_Queues instead 
of different interfaces. Can't be as simple as writing eth0 at 1, etc. in 
the cluster's node.cfg file. Maybe some changes to Bro code?

Sunjeet





More information about the Bro mailing list