[Bro] Bro and PF_RING Cluster ID

Tritium Cat tritium.cat at gmail.com
Thu Aug 2 13:13:24 PDT 2012


The CLUSTER_LEN depends on what version of PF_RING you use.  The latest
development build is set to 32.

You can set the cluster ID in the broctl.conf file but I'm not sure how
that works when more than one PF_RING interface is being used.  If it makes
sense then maybe leveraging the load balancing configuration and having
something like "lb_ring_id" ?



On Thu, Aug 2, 2012 at 7:47 PM, William Jones <jones at tacc.utexas.edu> wrote:

> It is not necessary for PF_RING to use different cluster id per capture
> interface.
>
> You can increase the the number of works per cluster id by changing
> CLUSTER_LEN linux/pf_ring.h from 8 to 16 or 32.
>
> There seems other limitation in the number of works on host in bro whne
> you gove above 8 works on a hosts.
>
>
> Bill Jones
>
> -----Original Message-----
> From: bro-bounces at bro-ids.org [mailto:bro-bounces at bro-ids.org] On Behalf
> Of Robert Rotsted
> Sent: Tuesday, July 31, 2012 5:36 PM
> To: bro at bro-ids.org
> Subject: [Bro] Bro and PF_RING Cluster ID
>
> Hi all,
>
> I'm running a clustered Bro instance with workers capturing traffic on
> three PF_RING enabled e1000e interfaces.
>
> While looking in /proc/net/pf_ring/ I noticed that all of my Bro workers
> belong to cluster id 21. Is it possible (or desirable) in Bro to create a
> PF_RING cluster id per capture interface?
>
> I read that PF_RING allows a maximum of eight workers per cluster id, is
> this still true?
>
> Best,
>
> Bob
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120802/174bb058/attachment.html 


More information about the Bro mailing list