[Bro] Triplicate Entries in CONN Log
seth at corelight.com
Wed Jan 3 11:57:34 PST 2018
On 3 Jan 2018, at 12:39, Philip Romero wrote:
> Thanks for the troubleshooting code. It looks like only one interface
> getting the traffic, but all 4 cores assigned are processing the same
> traffic individually. I'm still working with my Systems team on the
> suggestion from Justin.
Could you try removing all of the worker configs from node.cfg except
for worker-4? I'm curious if there is something we did that is causing
trouble for PF_Ring if multiple interfaces are being sniffed like that.
Seth Hall * Corelight, Inc * www.corelight.com
More information about the Bro