[Bro] Have a cluster infrastructure read pcaps

[erik clark]

Run mergecap against your files and run bro against the one pcap file that
way, Call it done.


>
> Hi all,
>
> I have an issue with processing multiple pcap files in bro.
> Due to the fact that loading all of bro's scripts and infrastructure is a
> time consuming task,
> processing each pcap file takes longer than it should.
>
> Is there any way that a bro cluster could be up and running and have it's
> workers process the pcap files ?
>
> btw, it needs to be a pcap file and not live capture using tcpreplay for
> transmitting them because of time issues (some sessions might be very long
> and bro will process the pcap file faster than retransmitting the same pcap
> file).
>
> If anyone can think of a better way to accomplish it, I am free for offers
> :)
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161030/2b628d89/attachment.html