[Oisf-users] What is cluster-id need for ?

[Eric Leblond]

Hello,

On Wed, 2016-08-31 at 19:22 +0300, oleg gv wrote:
> Hello, in suricata afp mode we need to set cluster-id for each of
> paired interfaces that used in afp.
> 
> For example we have such config (simplified):
> 
> afp: 
>   iface eth0: 
>       copy-to eth1
>       cluster-id 1
>    iface eth1
>        copy-to eth0
>        cluster-id 2
> 
> What if I set the same cluster-id (e.g. 1) for both interfaces ? 
> Or it must differ? 
> 
> On what things this influence?

cluster_id is the value of the cluster id inside the kernel. This value
is used to implement load balancing among raw sockets that have declare
the same cluster id. So different values ensure kernel will load
balance on the correct set of sockets. Kernel has check on the device
and all sockets using the same cluster_id must be connected to the same
device. This looks more like an implementation choice that cluster_id
must not be the same on 2 ifaces. By looking at the kernel code, it is
clear it is simplifying it.

I hope this help. 


BR,
-- 
Eric Leblond <eric at regit.org>