Cluster Bro configuration

Zeek
1

Hi all,

  I’m a newbie of Bro. I’m trying to configure a cluster bro using PF_RING. But, I don’t have PF_RING+DNA license. I just want to use two bro instances (workers) running at the same physical machine. Whether PF_RING can load balance the traffic between two workers? Should I config the worker in node.cfg file as following:

[worker-1]
type=worker
host=10.0.0.50
interface=eth4
lb_method=pf_ring
lb_procs=2
[worker-2]
type=worker
host=10.0.0.50
interface=eth4
lb_method=pf_ring
lb_procs=2

Best,
-xiaozhe

2

Hi,

You simply need

[worker]
type=worker
host=10.0.0.50
interface=eth4
lb_method=pf_ring
lb_procs=2

the lb_procs=2 will create the 2 workers for you.

3

Thank you very much for your reply.
Additionally, I want to know who splits the traffic into two parts. PF_RING or Bro worker? Is there any introduction (maybe some webpage) about this functionality?

Best,
-xiaozhe