# Cluster+PF\_RING doubt **URL:** \ **Category:** Zeek\ **Created:** [February 21, 2014, 11:08pm UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014 "2014-02-21T23:08:28Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Martin\_Andreoni](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Martin\_Andreoni](https://community.zeek.org/u/Martin_Andreoni)\ **Post date:** [February 21, 2014, 11:08pm UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014/1 "2014-02-21T23:08:28Z")
Hello community , I will ask you a newbie question about Bro and PF\_RING I am working in Bro Cluster topology, as it can be seen in the figure attached or in [http://www.freeimagehosting.net/newuploads/oevq9.png](http://www.freeimagehosting.net/newuploads/oevq9.png), all are XEN virtual machines working with the PF\_Ring. My intention is to make a load balancing. I am doing a UDP Flood attack from several machines in the 123.123.X.X network to one victim in the 192.168.1.X network. As you can imagine, I need to deviate the traffic to a Bro cluster to analyze it. As it can be seen in the figure, I put a worker sniffing the eth4 interface from the TAP (worker-5 is in the TAP VM). So here is my doubt. Should Bro, through the PF\_RING lib, automatically load balancing the traffic to all workers? or there is a mistake in my topology? As it is working now, I am just receiving all flow in the worker-5 and there is no balancing.   Thanks for your help. Below are the commands showing that Bro+PF\_ring are working: ![PF_RING.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/2c773564b9bb51d0c92c7de18557efc819298494.png) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 22, 2014, 1:50am UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014/2 "2014-02-22T01:50:32Z")
This is definitely not right. You aren't defining how many processes you want to spread the traffic across (with lb\_procs) and you have your other workers sniffing eth2 on their respective installations. PF\_Ring spreads the traffic on a single host, but you're running 4 separate hosts (ignoring the fact that they're VMs. Couple of questions…   - Why VMs?   - Why aren't you just allocating more CPU cores to worker-5 and using pf\_ring to balance the traffic across those cores? If you allocated more CPU cores to worker-5, your config would look like this… [worker-5] type=worker host=192.168.0.100 interface=eth4 lb\_method=pf\_ring lb\_procs=4 .Seth ---
**Author:** ![Martin\_Andreoni](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Martin\_Andreoni](https://community.zeek.org/u/Martin_Andreoni)\ **Post date:** [February 24, 2014, 7:38pm UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014/3 "2014-02-24T19:38:39Z")
Hi Seth, thanks for your answer, > > - Why VMs? We are using VM, because we are working in the Application layer of the cloud, we allocate VM dynamically. The Idea was to allocate VMs (Host) on the fly, doing load balancing between these hosts. > > PF\_Ring spreads the traffic on a single host. According to you, PF\_RING only spread network traffic inside the host between the CPU cores. Is it right this phrase? The cluster made by Bro should be just Inside a host? To make the load balancing between several hosts, like I am trying to do, I should use OpenFlow or another solution? Any suggestions? Thank you. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 24, 2014, 9:09pm UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014/4 "2014-02-24T21:09:47Z")
You have to figure something out. Unfortunately I have no suggestions.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/cluster-pf-ring-doubt/3014/5 "2022-05-06T15:41:36Z")
Closed on May 6, 2022, 3:41pm UTC