[Bro] Triplicate Entries in CONN Log

Seth Hall seth at corelight.com
Wed Jan 3 11:57:34 PST 2018

On 3 Jan 2018, at 12:39, Philip Romero wrote:

> Thanks for the troubleshooting code. It looks like only one interface 
> is
> getting the traffic, but all 4 cores assigned are processing the same
> traffic individually. I'm still working with my Systems team on the
> suggestion from Justin.  

Could you try removing all of the worker configs from node.cfg except 
for worker-4?  I'm curious if there is something we did that is causing 
trouble for PF_Ring if multiple interfaces are being sniffed like that.


Seth Hall * Corelight, Inc * www.corelight.com

More information about the Bro mailing list