<div dir="ltr">Thanks.<div><br></div><div>Your words helped me a lot.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">2019년 9월 3일 (화) 오전 10:40, Justin Azoff <<a href="mailto:justin@corelight.com">justin@corelight.com</a>>님이 작성:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Install <a href="https://github.com/ntop/bro-pf_ring" target="_blank">https://github.com/ntop/bro-pf_ring</a> in general for best results.<div><br></div><div>Use<br><div><br></div><div>interface=pf_ring::p1p1,p1p2<br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Sep 2, 2019 at 9:32 PM Raphael Shin <<a href="mailto:hkshin98@gmail.com" target="_blank">hkshin98@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I am installing Bro on Redhat OS.</div><div><br></div><div>My Bro machine has two interfaces.</div><div> - Interface#1(p1p1) : Server farm <b>inbound</b> traffic</div><div> - Interface#2(p1p2) : Server farm <b>outbound</b> traffic</div><div><br></div><div>I configured two interfaces with pf_ring.<br></div><div><br></div><div>node.cfg file is as follows.</div><div><br></div><div>----------------------------</div><div>[logger]<br>type=logger<br>host=localhost<br><br>[manager]<br>type=manager<br>host=localhost<br><br>[proxy-1]<br>type=proxy<br>host=localhost<br><br>[worker-1]<br>type=worker<br>host=localhost<br>interface=<b>p1p1</b><br>lb_method=pf_ring<br>lb_procs=2<br>pin_cpus=8,9<br><br>[worker-2]<br>type=worker<br>host=localhost<br>interface=<b>p1p2</b><br>lb_method=pf_ring<br>lb_procs=2<br>pin_cpus=10,11<br></div><div>---------------------------- <br></div><div><br></div><div><br></div><div>but, I had wrong connection information.</div><div><br></div><div>Most conn_state is SH or SHR in the conn.log file.</div><div><br></div><div>How can I configure the node.cfg file?</div><div><br></div><div>Thanks,</div><div>Raphael</div></div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail-m_-3390784537844473552gmail_signature"><div dir="ltr">Justin</div></div>
</blockquote></div>