答复:Re: Does BPF filter of worker has the ability of packet retransmition

Hi Vern,

The span of original sentence is a bit too large to understand for me. But understand now. Thanks for your reply.

DeJin Wang

======last communication cotent======

From : |
“Vern Paxson” vern@corelight.com;
|

  • | - |
    Date : | 09/24 2018 04:55:20 |
    To : | “wangdj@ffcs.cnwangdj@ffcs.cn |
    Cc : | “bro” bro@bro.org |
    Subject : | Re: [Bro] Does BPF filter of worker has the ability of packet retransmition |

“The packets can then be passed directly to a monitoring host where
each worker has a BPF filter to limit its visibility to only that stream
of flows, or onward to a commodity switch to split the traffic out to
multiple 1G interfaces for the workers.”

Does this sentence means worker`s BPF filter can retransmit packets to other switch?

The “or onward” part is talking about what the front-end does, rather than
what the workers do. The front end either sends all packets to a host
for which each individual worker applies a (disjoint) BPF filter to the
stream to pick out those flows specifically for it; or the front end can
send the traffic to a switch that explicitly load-balances the traffic
across multiple 1G interfaces.

Vern