[Bro] bro cluster with pf ring dna+libzero

[Seth Hall]

On Jun 19, 2014, at 5:14 PM, Li, Yee-Ting <ytl at slac.stanford.edu> wrote:

> is anyone using ZC pf_ring for bro?

2.3 should support using the zc load balancing tool.  If you follow the directions here:
	http://bro.org/documentation/load-balancing.html

you should be able use the same config as for pf_ring+DNA but you'll be sniffing an interface named zc:21 (or similar, the "21" is the cluster number that is auto assigned by broctl).  One issue with the zbalance_ipc tool that pf_ring ships with though is that you can't load balance to multiple applications like you could with the older pfdnacluster_master tool.  I couldn't figure out how to do it at least.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140624/28282542/attachment.bin