Update Bro Load-Balancing Documentation for PF_RING ZC

Description

It might be worth revisiting this doc and updating to account for the transition to PF_RING ZC from PF_RING DNA:

https://www.bro.org/documentation/load-balancing.html

A few things have changed on the PF_RING DNA side in broctl in regards to naming support "dnacl" instead of "dnacluster" due to problems with name length for dnaclusters with greater than 10 queues, and with the most recent releases of PF_RING (6.4+), DNA appears to have been removed finally in favor of the newer ZC according to the change notes.

From what I recall reading I don't believe it is terribly different outside of substituting ZC drivers (and tweaking huge-pages in the driver load script) in favor of DNA, and using zbalance_ipc instead of pfdnacluster_master. I want to say the naming in node.cfg becomes zc:<clusterid> instead of dnacl:<clusterid>.

I don't know that I'd remove the DNA documentation just yet in case folks are running older version, but a use case for ZC might be worth adding. I don't recall if there are both ZC with RSS and zbalance_ipc methods in Bro/broctl.

Also, speaking of ZC, NTOP has a blog post that might be worth taking a look at concerning alternate ways of implementing ZC / zbalance_ipc with bro to work around a problem that can occur when bro workers crash and get automatically restarted.

http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/

Environment

None

Assignee

Unassigned

Reporter

Gary Faulkner

Labels

External issue ID

None

Components

Affects versions

Priority

Normal
Configure