‘eth0 -i eth1’ makes half of con n.log count than ‘eth0’
김희철 <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAHs13Ah0u6JyGCGFoesp-dNLanBWv6dp+4De7ab48Kx4uc4Aiw@mail.gmail.com> |
Hi everyone I am having configure issue. In node.cfg , ‘eth0 -i eth1’ config makes half of conn.log count than ‘eth0’ there is no traffic in eth1, in live monitoring eth1 is standby. I test this live traffic and pfsend with pcap file from other server (pfsend is feeding only to eth0 port) Because of circumstances I can not use bridge setup. I must be missing something. Could any one point me to right direction? My setup is blow Zeek(bro) server cpu: Intel(R) Xeon(R) CPU E5-2650 X 2 (total 32 core) ram: 64G zeek(bro) 2.4.2 with pf_ring 7.5.0 (not a zc) no extra zeek(bro) script server has two monitoring port eth0(active), eth1 (standby) node.cfg 'eth0 -i eth1' [manager] type=manager host=localhost [proxy-1] type=proxy host=localhost [proxy-2] type=proxy host=localhost [monitor] type=worker host=localhost interface='eth0 -i eth1' lb_method=pf_ring lb_procs=10 pin_cpus=1,2,3,4,5,6,7,8,9,10 node.cfg eth0 [manager] type=manager host=localhost [proxy-1] type=proxy host=localhost [proxy-2] type=proxy host=localhost [monitor] type=worker host=localhost interface=eth0 lb_method=pf_ring lb_procs=10 pin_cpus=1,2,3,4,5,6,7,8,9,10 -- ------------------------------------------------------ Hichul Kim 김희철 선임 연구원 Naru Security (주)나루씨큐리티 _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek