[Bro] PF_RING Clustering Problem

[Martin Holste]

I updated the post to show the new, shorter config.


On Wed, Jun 19, 2013 at 12:06 PM, Seth Hall <seth at icir.org> wrote:

>
> On Jun 19, 2013, at 1:34 AM, Jeff Scaparra <jeff at scaparra.com> wrote:
>
> > I followed this howto
> http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.htmlhowever I am finding bro is now reporting 4 of everything so the load
> balancing isn't working. How can I verify PF_RING is load balancing or what
> could I be missing? Is there a better document I should be looking at?
>
> Those directions are outdated.  Instead of configuring separate workers
> you should configure a single worker per interface you are sniffing like
> this…
>
> [worker-1]
> host=1.2.3.4
> interface=eth0
> lb_method=pf_ring
> lb_procs=4
>
> That will automatically enable the pf_ring load balancing and start up
> four processes that the traffic on eth0 is load balanced across.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130621/6a70d815/attachment.html