[Bro] New Bro cluster

[John Edwards]

Hi

I currently have two bro stand alone workers analysing traffic. I am
building 6 more systems so in total i will have 1 Manager/Proxy and 3
workers per leg of my gateway i need to have visibility on.

I was going to spec out the workers the most and then im not 100% on the
front end worker options. Do i place the PF_RING on each worker and the
manager? Or just the workers? And i am not familiar with the other pieces
of hardware mentioned in the clustering guide as a front end option if I
don't use PF_RING . Would a F5 load balancer that had a VIP for the workers
sending traffic to the manager work just as good? Or not a good option?

Thanks
John
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161123/97af1963/attachment.html