[Bro] bro cluster and load balancers

[erik clark]

I still do not understand this... If I have

1. 1 manager node
2. 1 logger node
3. 2 worker nodes

and I load balance between the two worker nodes, how, if at all, does the
manager know if a session is split across multiple worker nodes? The worker
nodes (as mentioned before) would have to spit considerable amounts of
traffic information back up to the manager node. My load balancer uses 5
tuples to determine where to send traffic for a given session. I need to
limit the number of physical servers assigned to this cluster due to
budgetary constraints, and ideally, 2 stand alone worker/manager/logger all
in one systems would be more doable than 3 or 4 physical systems. I am
under the impression that in the previous thread on this, load balancing in
this way is impossible since conn tracking wouldn't work without a manager
handling both worker hosts???
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161011/174fe7d1/attachment.html