[Bro] Cluster+PF_RING doubt

[Martin Andreoni]

Hi Seth, thanks for your answer,

>>- Why VMs?

We are using VM, because we are working in the Application layer of the 
cloud, we allocate VM dynamically. The Idea was to allocate VMs (Host) 
on the fly, doing load balancing between these hosts.

>> PF_Ring spreads the traffic on a single host.

According to you, PF_RING only spread network traffic inside the host 
between the CPU cores. Is it right this phrase? The cluster made by Bro 
should be just Inside a host?
To make the load balancing between several hosts, like I am trying to 
do, I should use OpenFlow or another solution? Any suggestions?

Thank you.



On 02/21/2014 10:50 PM, Seth Hall wrote:
> On Feb 21, 2014, at 6:08 PM, Martin Andreoni<martin at gta.ufrj.br>  wrote:
>
>> [worker-4]
>> type=worker
>> host=192.168.0.61
>> interface=eth2
>> lb_method=pf_ring
>>
>> [worker-5]
>> type=worker
>> host=192.168.0.100
>> interface=eth4
>> lb_method=pf_ring
> This is definitely not right.  You aren't defining how many processes you want to spread the traffic across (with lb_procs) and you have your other workers sniffing eth2 on their respective installations.

> , but you're running 4 separate hosts (ignoring the fact that they're VMs.  Couple of questions…
>
>    - Why VMs?
>    - Why aren't you just allocating more CPU cores to worker-5 and using pf_ring to balance the traffic across those cores?
>   
> If you allocated more CPU cores to worker-5, your config would look like this…
>
> [worker-5]
> type=worker
> host=192.168.0.100
> interface=eth4
> lb_method=pf_ring
> lb_procs=4
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>


-- 

  

------------------------------------------------------------------------

  

*Martin Andreoni  *

/Msc. Student/

/Grupo de Teleinformática e Automação (GTA)/

/Programa de Engenharia Elétrica (PEE)/

/Universidade Federal do Rio de Janeiro (UFRJ)/

/www.gta.ufrj.br/~martin  <http://www.gta.ufrj.br/%7Emartin>/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140224/e6fc1309/attachment.html