As i have a standalone bro worker at the moment i am wanting to branch out and add more workers to the same link because of a high rate of packet loss.
the worker has the fibre card receiving the direct packet stream from our TAP. When i upgrade to cluster mode i will be building two more systems, one for the management/proxy/logger and then another worker.
As one worker will have the fibre card how does the worker number 2 or 3 or 4 in the future receive traffic to assist in processing the data feed? is the load shared between workers that reside on the same subnet? as the feed from the tap is just a passive fibre feed with no routing configured on it.
i hope each worker doesnt need to have a fibre card added into the same tap point.