> On 21 Jan 2016, at 04:54, Madhu R <[email protected]> wrote: > > > Hi , > I have a doubt regarding working of PF_RING as a load balancer with snort as > IDS/IPS , > > 1) Is PF_RING is able to do load balancing depending on the type of packets > (ex TCP, UDP, ICMP etc) to snort?
If you are using vanilla drivers you have a few options in the daq module (--daq-var clustermode=<mode>), setting mode to: - 2 for 2-tuple flow - 4 for 4-tuple flow - 5 for 5-tuple flow - 6 for 6-tuple flow If you are using PF_RING ZC, you can use hw RSS (4-tuple) or zbalance_ipc -m 1 which is an IP-based hash. If you need something more specific (e.g. protocol only), it is possible to define a custom distribution function in zbalance_ipc.c > 2) In case if its not possible is there a way to do load balancing depending > on type of packet ? > 3) Which example i need to consider for doing it or do i need to do > modification in the source code for the packet classification ? As above. Regards Alfredo > > Thanks and regards > Madhu > _______________________________________________ > Ntop-misc mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
