[Bro] How to use PF_RING multi?

Slagell, Adam J slagell at illinois.edu
Thu Nov 13 10:52:26 PST 2014


https://github.com/jsiwek/sshd_audit_mux

On Nov 13, 2014, at 12:37 PM, Joe Blow <blackhole.em at gmail.com<mailto:blackhole.em at gmail.com>> wrote:

would you mind posting the full working config?  I'm interested in this as well.

Cheers,

JB

On Thu, Nov 13, 2014 at 1:18 PM, Thomas, Eric D <edthoma at sandia.gov<mailto:edthoma at sandia.gov>> wrote:
I found the answer. I missed the lb_interfaces option.
--
Eric Thomas
edthoma at sandia.gov<mailto:edthoma at sandia.gov>

From: <Thomas>, "Thomas, Eric D" <edthoma at sandia.gov<mailto:edthoma at sandia.gov>>
Date: Thursday, November 13, 2014 10:05 AM
To: "bro at bro.org<mailto:bro at bro.org>" <bro at bro.org<mailto:bro at bro.org>>
Subject: How to use PF_RING multi?

What is the configuration needed to run bro with PF_RING using its link aggregation (multi) capability? This below (a snippet of node.cfg) doesn't do it:

[bro-pf]
type=worker
host=X.X.X.X
interface=multi:em1;em2
lb_method=pf_ring
lb_procs=8

--
Eric Thomas
edthoma at sandia.gov<mailto:edthoma at sandia.gov>

_______________________________________________
Bro mailing list
bro at bro-ids.org<mailto:bro at bro-ids.org>
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro<http://mailman.icsi.berkeley.edu/mailman/listinfo/bro>

_______________________________________________
Bro mailing list
bro at bro-ids.org<mailto:bro at bro-ids.org>
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

------

Adam J. Slagell
Chief Information Security Officer
Assistant Director, Cybersecurity Directorate
National Center for Supercomputing Applications
University of Illinois at Urbana-Champaign
www.slagell.info<http://www.slagell.info>

"Under the Illinois Freedom of Information Act (FOIA), any written communication to or from University employees regarding University business is a public record and may be subject to public disclosure."









-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20141113/33a2d990/attachment.html 


More information about the Bro mailing list