[Bro] Adding more bro workers

[John Edwards]

Hi all,


As i have a standalone bro worker at the moment i am wanting to branch out
and add more workers to the same link because of a high rate of packet loss.

the worker has the fibre card receiving the direct packet stream from our
TAP. When i upgrade to cluster mode i will be building two more systems,
one for the management/proxy/logger and then another worker.

As one worker will have the fibre card how does the worker number 2 or 3 or
4 in the future receive traffic to assist in processing the data feed? is
the load shared between workers that reside on the same subnet? as the feed
from the tap is just a passive fibre feed with no routing configured on it.

i hope each worker doesnt need to have a fibre card added into the same tap
point.

Cheers
John
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161124/b7682bad/attachment.html