Clustered AF_PACKET support
Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
This has already been removed for a while, closing.
Yes, please remove the change and just leave the configurable buffer if you can.
Going through libpcap which might or might not work taught us to write a packet source plugin instead, which won't depend on anything and less code is always nice.
Always nice to learn something.
Ok, I'l remove. Looking forward to the plugin!
@Robin: You are right. I have already started writing the AF_PACKET plugin for Bro and I can update my broctl patch as well.
I believe the conditions for it to work depend a little bit too much on libpcap. I would suggest removing it in favor of a separate af_packet plugin, but do leave the pcap buffer patch in place.