Alessandro actually in order to correctly distribute fragmented traffic among cluster instances you need to set enable_ip_defrag=1 or to use cluster_per_flow_2_tuple, probably we will change the default cluster type to the latter.
Regards Alfredo On Mar 15, 2012, at 7:12 PM, Alessandro Guido wrote: > If I understand correctly, PF_RING calculates a hash (which is the same in > both directions of the flow) using packet header informations to distribute > software among subscribers in a pfring cluster if "cluster_per_flow" mode is > selected, like the pfring snort DAQ does. However, in case of fragmented > traffic, some fields like source & destination ports are present only in the > packet that contains the lvl4 header. > > So, is enable_ip_defrag=1 needed to correctly distribute flows among cluster > instances in the case of fragmented traffic? > > Thanks, > Alessandro. > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
