[Bro] Triplicate Entries in CONN Log

[Seth Hall]

On 3 Jan 2018, at 12:39, Philip Romero wrote:

> Thanks for the troubleshooting code. It looks like only one interface 
> is
> getting the traffic, but all 4 cores assigned are processing the same
> traffic individually. I'm still working with my Systems team on the
> suggestion from Justin.  

Could you try removing all of the worker configs from node.cfg except 
for worker-4?  I'm curious if there is something we did that is causing 
trouble for PF_Ring if multiple interfaces are being sniffed like that.

   .Seth


--
Seth Hall * Corelight, Inc * www.corelight.com