I flow the https://www.bro.org/documentation/load-balancing.html build a balance cluster by using pfring.
the node.cfg is below:
[manager]
type=manager
host=10.2.27.208
[proxy-1]
type=proxy
host=10.2.27.208
[worker-1]
type=worker
host=10.2.27.208
interface=eth1
lb_method=pf_ring
lb_procs=4
pin_cpus=1,2,3,4
It is works well. I wrote a bro script want to receive events by broccoli.The script works well too.
Part of my script is blow:
…
redef Communication::nodes += {
[“http_detail”] = [$host = 10.2.27.208, $events = /http_detail/, $connect=T, $ssl=F]
};
…
And i found there is many port on the host 10.2.27.208:
tcp 0 0 0.0.0.0:47761 0.0.0.0:* LISTEN 5228/bro
tcp 0 0 0.0.0.0:47762 0.0.0.0:* LISTEN 5402/bro
tcp 0 0 0.0.0.0:47763 0.0.0.0:* LISTEN 6001/bro
tcp 0 0 0.0.0.0:47764 0.0.0.0:* LISTEN 6003/bro
tcp 0 0 0.0.0.0:47765 0.0.0.0:* LISTEN 6004/bro
tcp 0 0 0.0.0.0:47766 0.0.0.0:* LISTEN 6002/bro
Witch port I should connect ?