[Bro] zbalance_ipc with multiple applications and Bro

[Michał Purzyński]

Thanks a lot - it seems that my own build of Bro has been linked to
the system libpcap instead of the pf_ring one. I'm fighting with that
now, will update this thread with observations, once I get it working.

On Thu, Feb 12, 2015 at 5:08 AM, Seth Hall <seth at icir.org> wrote:
>
>> On Feb 11, 2015, at 10:14 AM, Michał Purzyński <michalpurzynski1 at gmail.com> wrote:
>>
>> Same for just zc:99 and not a surprise, Bro somehow needs to open
>> sub-interfaces 4-7.
>>
>> Is it even supported?
>
> It is actually. :)
>
> In node.cfg, you would config a worker like this…
>
> [worker-x]
> type=worker
> host=1.2.3.4
> interface=zc:99
> lb_method=pf_ring
> lb_procs=4
>
> In broctl.cfg, you’d set this…
>
> pfringfirstappinstance=4
>
> That should make it work.  Unfortunately pfringfirstappinstance is a global variable for broctl, but it was easier when I was implementing it and I would generally expect people to be running the same or substantially similar zbalance_ipc configurations  everywhere.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>