[Zeek] Using af_packet in a host with two nics

Patrick P Murphy pmurphy+bro at nrao.edu
Tue Jan 29 10:44:59 PST 2019


 Carlos Lopez <clopmz at outlook.com> writes:

CL> Uhmm ... I have changed my config to:
CL> [prod-ids]
CL> type=worker
CL> host=172.22.58.2
CL> interface=af_packet::eth2
CL> af_packet_fanout_id=5
CL> #
CL> [dmz-ids]
CL> type=worker
CL> host=172.22.58.2
CL> interface=af_packet::eth3
CL> af_packet_fanout_id=10

This may be a totally dumb/naive question, but... why do the
interfaces have the same IP address?  

 - Pat

-- 
Patrick P. Murphy, Ph.D.               https://www.nrao.edu/~pmurphy/
Info Services Site Manager          NRAO Information Security Officer


More information about the Zeek mailing list