[ https://bro-tracker.atlassian.net/browse/BIT-1481?page=com.atlassian.jira.p… ]
Robin Sommer reassigned BIT-1481:
---------------------------------
Assignee: Robin Sommer
> some test canonifiers don't always read from stdin
> --------------------------------------------------
>
> Key: BIT-1481
> URL: https://bro-tracker.atlassian.net/browse/BIT-1481
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Reporter: Daniel Thayer
> Assignee: Robin Sommer
>
> Some of the test canonifier scripts being used in the Bro test suite
> cannot reliably be combined with other canonifiers in a pipeline.
> For example, this works:
> TEST_DIFF_CANONIFIER="diff-remove-x509-names | diff-remove-timestamps"
> but switching the order of these canonifiers does not work:
> TEST_DIFF_CANONIFIER="diff-remove-timestamps | diff-remove-x509-names"
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1484?page=com.atlassian.jira.p… ]
Robin Sommer reassigned BIT-1484:
---------------------------------
Assignee: Robin Sommer
> topic/dnthayer/doc-fixes
> ------------------------
>
> Key: BIT-1484
> URL: https://bro-tracker.atlassian.net/browse/BIT-1484
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Reporter: Daniel Thayer
> Assignee: Robin Sommer
>
> The branch "topic/dnthayer/doc-fixes" in the bro repo contains various
> doc fixes and improvements that I've collected over the past two months.
> These are mostly just small fixes or clarifications based on user questions on
> the mailing list. The most significant changes are to the input framework
> and the GeoIP documentation.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1485?page=com.atlassian.jira.p… ]
Robin Sommer reassigned BIT-1485:
---------------------------------
Assignee: Robin Sommer
> add configure option to prevent building broker python bindings
> ---------------------------------------------------------------
>
> Key: BIT-1485
> URL: https://bro-tracker.atlassian.net/browse/BIT-1485
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro, Broker
> Reporter: Daniel Thayer
> Assignee: Robin Sommer
>
> There should be a configure option to prevent building the broker python bindings.
> Also, the summary output of configure should more clearly show whether or not
> pybroker will be built (for example, if you have an older version of swig, it's not easy
> to see the warning message about not being able to build python bindings).
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.p… ]
Michal Purzynski commented on BIT-1363:
---------------------------------------
Kris,
I've modified the example from the kernel documentation to support FANOUT and it works like it should. So it's definitely libpcap being the issue here.
> Clustered AF_PACKET support
> ---------------------------
>
> Key: BIT-1363
> URL: https://bro-tracker.atlassian.net/browse/BIT-1363
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: git/master
> Reporter: Michal Purzynski
> Attachments: pcap.c
>
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.p… ]
Michal Purzynski commented on BIT-1363:
---------------------------------------
I'm happy to review the code and test it.
> Clustered AF_PACKET support
> ---------------------------
>
> Key: BIT-1363
> URL: https://bro-tracker.atlassian.net/browse/BIT-1363
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: git/master
> Reporter: Michal Purzynski
> Attachments: pcap.c
>
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.p… ]
Jan Grashoefer commented on BIT-1363:
-------------------------------------
I have already started writing a POC for a plugin. In case it works as expected I am going to add TPACKET_V3 support. As I am not used to write C/C++ code I would be glad if you can help review/test my code.
> Clustered AF_PACKET support
> ---------------------------
>
> Key: BIT-1363
> URL: https://bro-tracker.atlassian.net/browse/BIT-1363
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: git/master
> Reporter: Michal Purzynski
> Attachments: pcap.c
>
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.p… ]
Kris Nielander edited comment on BIT-1363 at 9/28/15 10:55 AM:
---------------------------------------------------------------
I wouldn't mind putting some more effort into this to bring it to a separate, cleaner module.
was (Author: krisnielander):
I wouldn't mind putting some more effort into this to bring it to separate, cleaner module.
> Clustered AF_PACKET support
> ---------------------------
>
> Key: BIT-1363
> URL: https://bro-tracker.atlassian.net/browse/BIT-1363
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: git/master
> Reporter: Michal Purzynski
> Attachments: pcap.c
>
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)
[ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.p… ]
Kris Nielander commented on BIT-1363:
-------------------------------------
I wouldn't mind putting some more effort into this to bring it to separate, cleaner module.
> Clustered AF_PACKET support
> ---------------------------
>
> Key: BIT-1363
> URL: https://bro-tracker.atlassian.net/browse/BIT-1363
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: git/master
> Reporter: Michal Purzynski
> Attachments: pcap.c
>
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-07-011#70107)