Is there a way to change PF_RING’s cluster/tuple type within Bro? Such as a parameter I can include in node.cfg? I’m running Bro 2.2.
There is no such option in Bro 2.2, but I've created a git branch
"topic/dnthayer/ticket1108" in the broctl repository that
you can test if you want. In that branch, I've added a
new broctl option called "PFRINGClusterType" that you can
set in broctl.cfg in order to choose a different PF_RING cluster type.
-Daniel