[Bro] [EXTERNAL] Re: Multiple interfaces on 2.2-beta-4

[anthony kasza]

This makes me wonder if anyone has tried using linux containers to build
cluster nodes... Anyone?

-AK
On Sep 27, 2013 11:18 PM, "Darren Spruell" <phatbuckett at gmail.com> wrote:

> What about bonding/trunking interfaces on the host?
>
> DS
>
> On Fri, Sep 27, 2013 at 6:55 AM, Thomas, Eric D <edthoma at sandia.gov>
> wrote:
> > Thanks all for the replies. I'll try them all, starting with the easiest.
> > For the record, the interfaces are both half streams, so I don't think
> the
> > cluster method will work.
> >
> > --
> > Eric Thomas
> >
> > edthoma at sandia.gov
> >
> >
> >
> >
> > On 9/26/13 7:37 PM, "Justin Azoff" <JAzoff at albany.edu> wrote:
> >
> >>On Thu, Sep 26, 2013 at 10:27:29PM -0400, Seth Hall wrote:
> >>> I guess I don't really know what to say, sniffing multiple interfaces
> >>>was never something we actually supported when you run Bro with broctl
> >>>and we continue not to support it.  Generally we recommend merging
> >>>multiple streams of traffic upstream of where Bro receives the packets.
> >>
> >>What about with something like:
> >>
> >>[worker-1]
> >>type=worker
> >>host=localhost
> >>interface=eth0
> >>
> >>[worker-2]
> >>type=worker
> >>host=localhost
> >>interface=eth1
> >>
> >>as long as those aren't half streams from a tap, that should work,
> >>right?
> >>
> >>--
> >>-- Justin Azoff
> >>-- Network Security & Performance Analyst
> >
> >
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
>
> --
> Darren Spruell
> phatbuckett at gmail.com
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130927/07b1830a/attachment.html