[Bro] Bro 2.0 packets dropped

Machiel van Veen mvv at sentia.nl
Fri Feb 10 00:12:07 PST 2012


On Thursday 09 February 2012 14:55:07 Seth Hall wrote:
> On Feb 9, 2012, at 2:41 AM, Machiel van Veen wrote:
> > There have been no alerts regarding packet loss either. Thanks for you
> > support on this issue, back to clustering for me ;)
> 
> Great to hear!  Broadcom nics have the weirdest problems.
> 
> Are you doing network based clustering (multiple physical hosts)?
> 

I'm looking to run one physical host for now and add a second with several 
workers later. However load balancing has not worked yet, the module and 
driver are loaded and pfcount shows traffic but Bro reports everything triple, 
no load balancing.

Is there any configuration apart from configuring the manager, proxy and 
workers in node.cfg done in Bro to get this working? 

As I understood there should not be, as long as you link to the pf_ring 
enabled libpcap it should work when pf_ring is active.

Machiel.



More information about the Bro mailing list