[Bro] High orig_bytes value

Seth Hall seth at icir.org
Thu Sep 8 06:49:23 PDT 2016


> On Sep 8, 2016, at 4:57 AM, Danilo Nicolò <dani.nicolo at gmail.com> wrote:
> 
> Sorry for short information.
> I’m using Packet-bricks + Bro (2.5) + Netmap (plugin)

Thanks for the explanation of what you're doing, that's helpful. 

> Yesterday I removed Packet-bricks from the chain and the problem was solved.

That's good to know.

> Eth0 --\
> 
> Eth1 ------ Merge -> Slot -> LoadBalance ----- Slot -> Bro worker #1
> 
> Eth2 ---/                                                             \--- Slot -> Bro worker #2
> 
> Eth3 --/

 Have you tried just sniffing a single interface and doing load balancing?  Could you send the script you're running in packet-bricks?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list