[Bro] Bro and PF_RING Cluster ID

Robert Rotsted rrotsted at pdx.edu
Tue Jul 31 15:36:28 PDT 2012


Hi all,

I'm running a clustered Bro instance with workers capturing traffic on
three PF_RING enabled e1000e interfaces.

While looking in /proc/net/pf_ring/ I noticed that all of my Bro
workers belong to cluster id 21. Is it possible (or desirable) in Bro
to create a PF_RING cluster id per capture interface?

I read that PF_RING allows a maximum of eight workers per cluster id,
is this still true?

Best,

Bob



More information about the Bro mailing list