PF_RING's greatest feature is the ability to do per-flow clustering so that many sniffers can run in parallel on their own CPU and each receive a portion of the traffic which has been load-balanced. Snort and Suricata both support this, and we've come to rely on it as we don't have access to hardware load balancing. Is there a way to do this in Bro?