[Bro] zbalance_ipc with multiple applications and Bro

[DJ Root]

Hi Michal,

It may be supported, but we have tested and proven similar functionality in hardware.  Our hardware and software can bind specific instances of Bro (or Suricata for that matter) onto host cores - something we call flow affinity.  Furthermore, those flows are load balanced anyway the user wants them.

Example config:  We compile both Bro and Suricata against our pcap libraries so that they each recognize our network interface nomenclature. In the case for “Bro”, we edit the “/usr/local/bro/etc/node.cfg" file to add the interface bindings and cpu pinning for each worker thread. See below. We then use “broctl” to start Bro processing.

[worker-1]
type=worker
host=172.24.3.9
pin_cpus=0
interface=nfe0.1.0

[worker-2]
type=worker
host=172.24.3.9
pin_cpus=1
interface=nfe0.1.1

[worker-3]
type=worker
host=172.24.3.9
pin_cpus=2
interface=nfe0.1.2

[worker-4]
type=worker
host=172.24.3.9
pin_cpus=3
interface=nfe0.1.3

Note nfe = Netronome Flow Engine

Regards,
DJ
> On Feb 11, 2015, at 10:14 AM, Michał Purzyński <michalpurzynski1 at gmail.com> wrote:
> 
> Hi.
> 
> I'm trying to start Bro and Suricata on one sensor, using the pf_ring
> ZC, like this
> 
> zbalance_ipc -i eth5 -c 99 -n 4,4 -m 1
> 
> where 99 is the cluster ID and -n <num>,<num> creates separate rings
> for each application. So far so good.
> 
> I should tell Bro to somehow bind to the zc:99 at 4, zc:99 at 5, zc:99 at 6,
> zc:99 at 7 interfaces. How can I do it?
> 
> Using zc:99 at 4 (AKA base, and let it increment automatically) does not work
> 
> fatal error: /opt/bro/bin/bro: problem with interface zc:99 at 4 -
> pcap_open_live: zc:99 at 4: No such device exists (SIOCGIFHWADDR: No such
> device)
> 
> Same for just zc:99 and not a surprise, Bro somehow needs to open
> sub-interfaces 4-7.
> 
> Is it even supported?
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro