Re: How to configure multiple interfaces
Raphael Shin <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAC41-JXOApSykz9kx9o5N16=PEcXEVUeuasWw0v0CZorQr_r5g@mail.gmail.com> |
Thanks. Your words helped me a lot. 2019년 9월 3일 (화) 오전 10:40, Justin Azoff <[email protected]>님이 작성: > Install https://github.com/ntop/bro-pf_ring in general for best results. > > Use > > interface=pf_ring::p1p1,p1p2 > > On Mon, Sep 2, 2019 at 9:32 PM Raphael Shin <[email protected]> wrote: > >> Hi, >> >> I am installing Bro on Redhat OS. >> >> My Bro machine has two interfaces. >> - Interface#1(p1p1) : Server farm *inbound* traffic >> - Interface#2(p1p2) : Server farm *outbound* traffic >> >> I configured two interfaces with pf_ring. >> >> node.cfg file is as follows. >> >> ---------------------------- >> [logger] >> type=logger >> host=localhost >> >> [manager] >> type=manager >> host=localhost >> >> [proxy-1] >> type=proxy >> host=localhost >> >> [worker-1] >> type=worker >> host=localhost >> interface=*p1p1* >> lb_method=pf_ring >> lb_procs=2 >> pin_cpus=8,9 >> >> [worker-2] >> type=worker >> host=localhost >> interface=*p1p2* >> lb_method=pf_ring >> lb_procs=2 >> pin_cpus=10,11 >> ---------------------------- >> >> >> but, I had wrong connection information. >> >> Most conn_state is SH or SHR in the conn.log file. >> >> How can I configure the node.cfg file? >> >> Thanks, >> Raphael >> _______________________________________________ >> Zeek mailing list >> [email protected] >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > > > > -- > Justin > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek