<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">You can unsubscribe here: <a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" class="">http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek</a><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Sep 3, 2019, at 3:42 AM, Иван Раткин <<a href="mailto:adh.2234@gmail.com" class="">adh.2234@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<title class=""></title>
<div class="">
<div name="messageBodySection" class="">
<div dir="auto" class="">Guys, remove me from this, please. IDK how to stop recieving your emails about Bro.
<div dir="auto" class="">Thanks.</div>
</div>
</div>
<div name="messageReplySection" class="">3 сент. 2019 г., 4:32 +0300, Raphael Shin <<a href="mailto:hkshin98@gmail.com" class="">hkshin98@gmail.com</a>>, писал:<br class="">
<blockquote type="cite" class="spark_quote" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #1abc9c;">
<div dir="ltr" class="">Hi,
<div class=""><br class=""></div>
<div class="">I am installing Bro on Redhat OS.</div>
<div class=""><br class=""></div>
<div class="">My Bro machine has two interfaces.</div>
<div class=""> - Interface#1(p1p1) : Server farm <b class="">inbound</b> traffic</div>
<div class=""> - Interface#2(p1p2) : Server farm <b class="">outbound</b> traffic</div>
<div class=""><br class=""></div>
<div class="">I configured two interfaces with pf_ring.<br class=""></div>
<div class=""><br class=""></div>
<div class="">node.cfg file is as follows.</div>
<div class=""><br class=""></div>
<div class="">----------------------------</div>
<div class="">[logger]<br class="">
type=logger<br class="">
host=localhost<br class="">
<br class="">
[manager]<br class="">
type=manager<br class="">
host=localhost<br class="">
<br class="">
[proxy-1]<br class="">
type=proxy<br class="">
host=localhost<br class="">
<br class="">
[worker-1]<br class="">
type=worker<br class="">
host=localhost<br class="">
interface=<b class="">p1p1</b><br class="">
lb_method=pf_ring<br class="">
lb_procs=2<br class="">
pin_cpus=8,9<br class="">
<br class="">
[worker-2]<br class="">
type=worker<br class="">
host=localhost<br class="">
interface=<b class="">p1p2</b><br class="">
lb_method=pf_ring<br class="">
lb_procs=2<br class="">
pin_cpus=10,11<br class=""></div>
<div class="">---------------------------- <br class=""></div>
<div class=""><br class=""></div>
<div class=""><br class=""></div>
<div class="">but, I had wrong connection information.</div>
<div class=""><br class=""></div>
<div class="">Most conn_state is SH or SHR in the conn.log file.</div>
<div class=""><br class=""></div>
<div class="">How can I configure the node.cfg file?</div>
<div class=""><br class=""></div>
<div class="">Thanks,</div>
<div class="">Raphael</div>
</div>
_______________________________________________<br class="">
Zeek mailing list<br class="">
<a href="mailto:zeek@zeek.org" class="">zeek@zeek.org</a><br class="">
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" class="">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><br class=""></blockquote>
</div>
</div>
_______________________________________________<br class="">Zeek mailing list<br class=""><a href="mailto:zeek@zeek.org" class="">zeek@zeek.org</a><br class="">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</div></blockquote></div><br class=""></body></html>