[Bro] Interface bonding w/ Bro 1.5.1

[Seth Hall]

On Apr 5, 2010, at 3:34 PM, William Jones wrote:

> interface="eth0  -Ieth1"


If you do this, you have to be aware that other pieces of  
functionality with BroControl will break or work in odd ways.  If your  
traffic doesn't need to be recombined (you have complete sessions on  
each interface) it probably makes more sense to run your sensor as a  
single host cluster and have a cluster worker watch each interface.

   .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721