[Bro] Cluster+PF_RING doubt

Seth Hall seth at icir.org
Fri Feb 21 17:50:32 PST 2014


On Feb 21, 2014, at 6:08 PM, Martin Andreoni <martin at gta.ufrj.br> wrote:

> [worker-4]
> type=worker
> host=192.168.0.61
> interface=eth2
> lb_method=pf_ring
> 
> [worker-5]
> type=worker
> host=192.168.0.100
> interface=eth4
> lb_method=pf_ring

This is definitely not right.  You aren't defining how many processes you want to spread the traffic across (with lb_procs) and you have your other workers sniffing eth2 on their respective installations.  PF_Ring spreads the traffic on a single host, but you're running 4 separate hosts (ignoring the fact that they're VMs.  Couple of questions…

  - Why VMs?
  - Why aren't you just allocating more CPU cores to worker-5 and using pf_ring to balance the traffic across those cores?
 
If you allocated more CPU cores to worker-5, your config would look like this…

[worker-5]
type=worker
host=192.168.0.100
interface=eth4
lb_method=pf_ring
lb_procs=4

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140221/c5482f9a/attachment.bin 


More information about the Bro mailing list