# How to confige the "cluster type" using PF\_RING doing loadbalance
**URL:** https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809
**Category:** Zeek
**Tags:** development
**Created:** [November 24, 2022, 8:47am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809 "2022-11-24T08:47:53Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@frank](https://community.zeek.org/u/frank)
#### Post date: [November 24, 2022, 8:47am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809/1 "2022-11-24T08:47:53Z")
any configuration can be set to specify the tuple-type of PF\_RING(without ZC).
I am running zeek 5.0.2.
configurations likes follows:
[worker-1]
type=worker
host=localhost
interface=enp3s0
lb\_method=pf\_ring
lb\_procs=6
pin\_cpus=3,5,7,11,13,15
and which tuple-type zeek used ?
---
### Author:  [@awelzel](https://community.zeek.org/u/awelzel)
#### Post date: [November 24, 2022, 9:31am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809/2 "2022-11-24T09:31:57Z")
> and which tuple-type zeek used ?
The default is 4-tuple as documented in the zeekctl doc:
> PFRINGClusterType (string, default “4-tuple”)
> If PF\_RING flow-based load balancing is desired, this is where the PF\_RING cluster type is defined. Allowed values are: 2-tuple, 4-tuple, 5-tuple, tcp-5-tuple, 6-tuple, or round-robin. Zeek must be linked with PF\_RING’s libpcap wrapper and PFRINGClusterID must be non-zero for this option to work.
In your configuration section for worker-1, you can set any of the above mentioned values.
There’s a PR that adds a few more load balancing methods (specifically “inner” ones) in case that’s interesting to you.
>
>
> This PR adds support for the more recent "INNER" clustering strategies of PF\_RIN…G. These allow load balancing according to the IP addresses and ports inside (for instance) GRE tunnels, rather than according to the tunnel's IP. This was leading to huge balancing issues on some sensors we run.
>
> The features themselves have been present in the PF\_RING driver for a while, and my patch for PF\_RING's libpcap has recently been merged: https://github.com/ntop/PF\_RING/commit/7a2d111b6f7ff18339d0906729a7400773b96ff3
---
### Author:  [@frank](https://community.zeek.org/u/frank)
#### Post date: [November 24, 2022, 10:05am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809/4 "2022-11-24T10:05:46Z")
Thanks.
I changed the configuration to follows:
[worker-1]
type=worker
host=localhost
interface=enp3s0
lb\_method=pf\_ring
lb\_procs=6
pin\_cpus=3,5,7,11,13,15
env\_vars=PCAP\_PF\_RING\_CLUSTER\_ID=99
[worker-2]
type=worker
host=localhost
interface=enp3s0
lb\_method=pf\_ring
lb\_procs=6
pin\_cpus=2,4,6,10,12,14
env\_vars=PCAP\_PF\_RING\_CLUSTER\_ID=99
I don’t specify the tuple-type in configuration, I checked the sourcecode in libpcap, the default type is PCAP\_PF\_RING\_USE\_CLUSTER\_PER\_FLOW\_5\_TUPLE
---
### Author:  [@awelzel](https://community.zeek.org/u/awelzel)
#### Post date: [November 24, 2022, 11:13am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809/5 "2022-11-24T11:13:54Z")
> I don’t specify the tuple-type in configuration, I checked the sourcecode in libpcap, the default type is PCAP\_PF\_RING\_USE\_CLUSTER\_PER\_FLOW\_5\_TUPLE
Hmm, please double check the environment of one of your workers (`cat /proc//environ | tr '\0' '\n'`) for pfring related environment variables.
Because you’re using zeekctl, it should be defaulting to 4-tuple and setting `PCAP_PF_RING_USE_CLUSTER_PER_FLOW_4_TUPLE` which may not be what you want.
Consider setting `PFRINGClusterType` if that’s not what you want.
You can also replace ` env_vars=PCAP_PF_RING_CLUSTER_ID=99` with setting `PFRINGClusterID`.
---
### Author:  [@frank](https://community.zeek.org/u/frank)
#### Post date: [November 24, 2022, 11:47am UTC](https://community.zeek.org/t/how-to-confige-the-cluster-type-using-pf-ring-doing-loadbalance/6809/6 "2022-11-24T11:47:43Z")
> [@frank](#):
>
> PCAP\_PF\_RING\_CLUSTER\_ID
Thanks for your detail comments.
Now I am clear about this feature.
Thanks