# "bro-cluster-in-a-box-setup" to "zeek-cluster-in-a-box-setup"?

**URL:** <https://community.zeek.org/t/bro-cluster-in-a-box-setup-to-zeek-cluster-in-a-box-setup/5995>\
**Category:** Zeek\
**Created:** [February 5, 2020, 11:49pm UTC](https://community.zeek.org/t/bro-cluster-in-a-box-setup-to-zeek-cluster-in-a-box-setup/5995 "2020-02-05T23:49:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Klaus](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Andrew\_Klaus](https://community.zeek.org/u/Andrew_Klaus)\
**Post date:** [February 5, 2020, 11:49pm UTC](https://community.zeek.org/t/bro-cluster-in-a-box-setup-to-zeek-cluster-in-a-box-setup/5995/1 "2020-02-05T23:49:11Z")

</div>

Hi Michal,

We’re working with Zeek on the same project as Paul and have opted to use Zeek within a Docker container since it works better for our workflow. It’s my first time using AF\_PACKET, so it would be nice to have a second set of eyes from you on it if you don’t mind 🙂

I’ve bridged all interfaces that need to be analyzed:  
[https://github.com/cybera/jsp-zeek/blob/master/host/60-zeek-bridge.yaml](https://github.com/cybera/jsp-zeek/blob/master/host/60-zeek-bridge.yaml)

Then I’ve disabled hardware features on the NIC, which is done on each boot: [https://github.com/cybera/jsp-zeek/blob/master/host/ethtool.sh](https://github.com/cybera/jsp-zeek/blob/master/host/ethtool.sh)

Using “interface=af\_packet::br0”, and pinning CPUs for the workers, manager, and proxy: [https://github.com/cybera/jsp-zeek/blob/master/docker/files/etc/node.cfg](https://github.com/cybera/jsp-zeek/blob/master/docker/files/etc/node.cfg)

We don’t have a ton of traffic being analyzed yet, but want to make sure we have a decent setup for when we start ingesting more data. I’ve pieced this together from various Zeek articles I’ve read, so hopefully it’s not too much of a Frankenstein’s Monster 😉

Any help would be appreciated!

Cheers,  
Andrew

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/bro-cluster-in-a-box-setup-to-zeek-cluster-in-a-box-setup/5995/2 "2022-05-06T15:47:03Z")

</div>

Closed on May 6, 2022, 3:47pm UTC