[Zeek] Using af_packet in a host with two nics

Carlos Lopez clopmz at outlook.com
Tue Jan 29 11:09:41 PST 2019


On 29/01/2019, 19:37, "Patrick P Murphy" <pmurphy at nrao.edu> wrote:

     Carlos Lopez <clopmz at outlook.com> writes:
    
    CL> Uhmm ... I have changed my config to:
    CL> [prod-ids]
    CL> type=worker
    CL> host=172.22.58.2
    CL> interface=af_packet::eth2
    CL> af_packet_fanout_id=5
    CL> #
    CL> [dmz-ids]
    CL> type=worker
    CL> host=172.22.58.2
    CL> interface=af_packet::eth3
    CL> af_packet_fanout_id=10
    
    This may be a totally dumb/naive question, but... why do the
    interfaces have the same IP address?  
    

Because this host has two network interfaces ....
 




More information about the Zeek mailing list