[Bro] Interface bonding w/ Bro 1.5.1

Seth Hall hall.692 at osu.edu
Mon Apr 5 12:52:58 PDT 2010

On Apr 5, 2010, at 3:34 PM, William Jones wrote:

> interface="eth0  -Ieth1"

If you do this, you have to be aware that other pieces of  
functionality with BroControl will break or work in odd ways.  If your  
traffic doesn't need to be recombined (you have complete sessions on  
each interface) it probably makes more sense to run your sensor as a  
single host cluster and have a cluster worker watch each interface.


Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721

More information about the Bro mailing list