[Bro] Update on using PF_RING/TNAPI with Bro
Justin Azoff
JAzoff at uamail.albany.edu
Wed Dec 15 19:14:47 PST 2010
On Wed, Dec 15, 2010 at 05:11:18PM -0500, Sunjeet Singh wrote:
> Yes, that's a great idea. But I'm not sure how Bro would handle
> manager-proxy-worker communication between different RX_Queues instead
> of different interfaces. Can't be as simple as writing eth0 at 1, etc. in
> the cluster's node.cfg file. Maybe some changes to Bro code?
>
> Sunjeet
Putting eth0 at 1,2,3,4 ec. in node.cfg should work just fine.
no changes to bro are needed, but you may have to rebuild bro with
./configure --enable-cluster...
the config I use with click just has:
[manager]
type=manager
host=10.10.1.12
[proxy-1]
type=proxy
host=10.10.1.12
[worker-1]
type=worker
host=10.10.1.12
interface=tap0
[worker-2]
type=worker
host=10.10.1.12
interface=tap1
[worker-3]
type=worker
host=10.10.1.12
interface=tap2
[worker-4]
type=worker
host=10.10.1.12
interface=tap3
--
-- Justin Azoff
-- Network Security & Performance Analyst
More information about the Bro
mailing list