[Bro] Bro 2.0 packets dropped

[Machiel van Veen]

On Friday 10 February 2012 15:25:04 Seth Hall wrote:
> On Feb 10, 2012, at 3:12 AM, Machiel van Veen wrote:
> > Is there any configuration apart from configuring the manager, proxy and
> > workers in node.cfg done in Bro to get this working?
> 
> Could you send me the content of your node.cfg and broctl.cfg files?  This
>  is fortunate timing, I've been preparing a blog post about using PF_Ring
>  load balancing with Bro and it would be good to find out if there are any
>  problems with it.
> 
>   .Seth

I'm using the following in node.cfg:

[manager]
type=manager
host=10.0.0.42

[proxy-1]
type=proxy
host=10.0.0.42

[worker-1]
type=worker
host=10.0.0.42
interface=p1p1

[worker-2]
type=worker
host=10.0.0.42
interface=p1p1

[worker-3]
type=worker
host=10.0.0.42
interface=p1p1

And these settings in broctl.cfg:

MailTo = root at localhost
SitePolicyStandalone = local.bro
SpoolDir = /var/opt/bro/spool
LogDir = /var/opt/bro/logs
LogRotationInterval = 3600
MinDiskSpace = 5
Debug = 1

Regards, Machiel.