# bro packet session spliting when using multiple interface

**URL:** <https://community.zeek.org/t/bro-packet-session-spliting-when-using-multiple-interface/6367>\
**Category:** Zeek\
**Created:** [June 25, 2021, 10:47am UTC](https://community.zeek.org/t/bro-packet-session-spliting-when-using-multiple-interface/6367 "2021-06-25T10:47:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [June 25, 2021, 10:47am UTC](https://community.zeek.org/t/bro-packet-session-spliting-when-using-multiple-interface/6367/1 "2021-06-25T10:47:13Z")

</div>

Hi,

In our setup we use 2 interfaces for capturing bro traffic, one for inbound and another one for outbound traffic, but we have one issue on this, session split issue. we are seeing wrong conn\_state flags, and tried different configurations , can any one help on this issue  
we are using bro with pf\_ring

configuration we tried node.cfg

conf1:  
[worker-1]  
type=worker  
host=localhost  
interface=‘eth10 -i eth11’  
lb\_method=pf\_ring  
lb\_procs=8

Conf2:

[worker-1]  
type=worker  
host=localhost  
interface=pf\_ring::eth10,eth11  
lb\_method=pf\_ring  
lb\_procs=8  
#pin\_cpus=24,25,26,27,28,29,30,31

Regards,  
Sunu P S

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/bro-packet-session-spliting-when-using-multiple-interface/6367/2 "2022-05-06T15:47:42Z")

</div>