New Bro cluster


I currently have two bro stand alone workers analysing traffic. I am building 6 more systems so in total i will have 1 Manager/Proxy and 3 workers per leg of my gateway i need to have visibility on.

I was going to spec out the workers the most and then im not 100% on the front end worker options. Do i place the PF_RING on each worker and the manager? Or just the workers? And i am not familiar with the other pieces of hardware mentioned in the clustering guide as a front end option if I don’t use PF_RING . Would a F5 load balancer that had a VIP for the workers sending traffic to the manager work just as good? Or not a good option?