[Bro] High orig_bytes value
seth at icir.org
Thu Sep 8 06:49:23 PDT 2016
> On Sep 8, 2016, at 4:57 AM, Danilo Nicolò <dani.nicolo at gmail.com> wrote:
> Sorry for short information.
> I’m using Packet-bricks + Bro (2.5) + Netmap (plugin)
Thanks for the explanation of what you're doing, that's helpful.
> Yesterday I removed Packet-bricks from the chain and the problem was solved.
That's good to know.
> Eth0 --\
> Eth1 ------ Merge -> Slot -> LoadBalance ----- Slot -> Bro worker #1
> Eth2 ---/ \--- Slot -> Bro worker #2
> Eth3 --/
Have you tried just sniffing a single interface and doing load balancing? Could you send the script you're running in packet-bricks?
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro