If I understand correctly, PF_RING calculates a hash (which is the same in both directions of the flow) using packet header informations to distribute software among subscribers in a pfring cluster if "cluster_per_flow" mode is selected, like the pfring snort DAQ does. However, in case of fragmented traffic, some fields like source & destination ports are present only in the packet that contains the lvl4 header.
So, is enable_ip_defrag=1 needed to correctly distribute flows among cluster instances in the case of fragmented traffic? Thanks, Alessandro.
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
