[Bro] bro cluster and load balancers

[Jan Grashöfer]

> and I load balance between the two worker nodes, how, if at all, does the
> manager know if a session is split across multiple worker nodes? The worker
> nodes (as mentioned before) would have to spit considerable amounts of
> traffic information back up to the manager node. My load balancer uses 5
> tuples to determine where to send traffic for a given session.

I guess by session you mean connection: If your load balancer uses
5-tuples *symmetrically* there shouldn't be any split connection.
Accordingly each connection can be analyzed by a worker without
interaction with other nodes. State that is shared across the cluster
depends on the scripts (e.g., scan.bro), which build upon the events
spit out by the analyzers. So there is no need to send traffic to other
nodes of the cluster.

Jan