[Bro-Dev] #943: PF_Ring plugin to support load balancing while sniffing multiple interfaces

[Seth Hall]

On Apr 26, 2013, at 1:08 PM, William Jones <jones at tacc.utexas.edu> wrote:

> I read from multiple interfaces per worker,  a consequence of of using taps to monitor a two port 10 GigE LACP pair.  The net


This is fixing a different problem.  People have been having trouble monitoring two separate links that don't see split routing.  The problem you're encountering is something that most people have been fixing by merging the traffic streams before sending them into the analysis box with a separate piece of hardware (it would typically get load balanced at the same time too).

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/