[Bro] zbalance_ipc with multiple applications and Bro

[Seth Hall]

> On Feb 11, 2015, at 10:14 AM, Michał Purzyński <michalpurzynski1 at gmail.com> wrote:
> 
> Same for just zc:99 and not a surprise, Bro somehow needs to open
> sub-interfaces 4-7.
> 
> Is it even supported?

It is actually. :)

In node.cfg, you would config a worker like this…

[worker-x]
type=worker
host=1.2.3.4
interface=zc:99
lb_method=pf_ring
lb_procs=4

In broctl.cfg, you’d set this…

pfringfirstappinstance=4

That should make it work.  Unfortunately pfringfirstappinstance is a global variable for broctl, but it was easier when I was implementing it and I would generally expect people to be running the same or substantially similar zbalance_ipc configurations  everywhere.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/