[Bro] [bro] Problem of Broccoli Connect to Bro load balance cluster

[vwmb王明博]

I flow the  https://www.bro.org/documentation/load-balancing.html  build a balance cluster by using pfring.
the node.cfg is below:

[manager]
type=manager
host=10.2.27.208

[proxy-1]
type=proxy
host=10.2.27.208

[worker-1]
type=worker
host=10.2.27.208
interface=eth1
lb_method=pf_ring
lb_procs=4
pin_cpus=1,2,3,4

It is works well. I wrote  a bro script want to receive events by broccoli.The script works well too.
Part of my script is blow:

...
redef Communication::nodes += {
       ["http_detail"] = [$host = 10.2.27.208, $events = /http_detail/, $connect=T, $ssl=F]
};
…

And i found there is many port on the host 10.2.27.208:
tcp        0      0 0.0.0.0:47761               0.0.0.0:*                   LISTEN      5228/bro
tcp        0      0 0.0.0.0:47762               0.0.0.0:*                   LISTEN      5402/bro
tcp        0      0 0.0.0.0:47763               0.0.0.0:*                   LISTEN      6001/bro
tcp        0      0 0.0.0.0:47764               0.0.0.0:*                   LISTEN      6003/bro
tcp        0      0 0.0.0.0:47765               0.0.0.0:*                   LISTEN      6004/bro
tcp        0      0 0.0.0.0:47766               0.0.0.0:*                   LISTEN      6002/bro

Witch port  I should  connect ?








-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150711/e3c50997/attachment.html