[Bro] 答复：Re: Does BPF filter of worker has the ability of packet retransmition

[王德劲]

Hi Vern,
The span of original sentence is a bit too large to understand for me. But understand now.  Thanks for your reply.
DeJin Wang
======last communication cotent======From :"Vern Paxson" <vern at corelight.com>; Date :09/24 2018 04:55:20To :"wangdj at ffcs.cn" <wangdj at ffcs.cn>Cc :"bro" <bro at bro.org>Subject :Re: [Bro] Does BPF filter of worker has the ability of packet retransmition 
>  "The packets can then be passed directly to a monitoring host where
> each worker has a BPF filter to limit its visibility to only that stream
> of flows, or onward to a commodity switch to split the traffic out to
> multiple 1G interfaces for the workers."
> 
> Does this sentence means worker`s BPF filter can retransmit packets to other switch? 
The "or onward" part is talking about what the front-end does, rather than
what the workers do.  The front end *either* sends all packets to a host
for which each individual worker applies a (disjoint) BPF filter to the
stream to pick out those flows specifically for it; *or* the front end can
send the traffic to a switch that explicitly load-balances the traffic
across multiple 1G interfaces.
        Vern
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180924/8c1f8737/attachment.html