[Bro] Update on using PF_RING/TNAPI with Bro

Justin Azoff JAzoff at uamail.albany.edu
Wed Dec 15 19:14:47 PST 2010


On Wed, Dec 15, 2010 at 05:11:18PM -0500, Sunjeet Singh wrote:
> Yes, that's a great idea. But I'm not sure how Bro would handle 
> manager-proxy-worker communication between different RX_Queues instead 
> of different interfaces. Can't be as simple as writing eth0 at 1, etc. in 
> the cluster's node.cfg file. Maybe some changes to Bro code?
> 
> Sunjeet

Putting eth0 at 1,2,3,4 ec. in node.cfg should work just fine.
no changes to bro are needed, but you may have to rebuild bro with
./configure --enable-cluster...

the config I use with click just has:

[manager]
type=manager
host=10.10.1.12

[proxy-1]
type=proxy
host=10.10.1.12

[worker-1]
type=worker
host=10.10.1.12
interface=tap0

[worker-2]
type=worker
host=10.10.1.12
interface=tap1

[worker-3]
type=worker
host=10.10.1.12
interface=tap2

[worker-4]
type=worker
host=10.10.1.12
interface=tap3


-- 
-- Justin Azoff
-- Network Security & Performance Analyst



More information about the Bro mailing list