# Cluster Bro configuration

**URL:** <https://community.zeek.org/t/cluster-bro-configuration/4002>\
**Category:** Zeek\
**Created:** [February 9, 2016, 5:51pm UTC](https://community.zeek.org/t/cluster-bro-configuration/4002 "2016-02-09T17:51:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xiaozhe\_shao](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhe\_shao](https://community.zeek.org/u/xiaozhe_shao)\
**Post date:** [February 9, 2016, 5:51pm UTC](https://community.zeek.org/t/cluster-bro-configuration/4002/1 "2016-02-09T17:51:10Z")

</div>

Hi all,

&nbsp;&nbsp;I’m a newbie of Bro. I’m trying to configure a cluster bro using PF\_RING. But, I don’t have PF\_RING+DNA license. I just want to use two bro instances (workers) running at the same physical machine. Whether PF\_RING can load balance the traffic between two workers? Should I config the worker in node.cfg file as following:

[worker-1]  
type=worker  
host=10.0.0.50  
interface=eth4  
lb\_method=pf\_ring  
lb\_procs=2  
[worker-2]  
type=worker  
host=10.0.0.50  
interface=eth4  
lb\_method=pf\_ring  
lb\_procs=2

Best,  
-xiaozhe

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [February 9, 2016, 5:58pm UTC](https://community.zeek.org/t/cluster-bro-configuration/4002/2 "2016-02-09T17:58:17Z")

</div>

Hi,

You simply need

[worker]  
type=worker  
host=10.0.0.50  
interface=eth4  
lb\_method=pf\_ring  
lb\_procs=2

the lb\_procs=2 will create the 2 workers for you.

---

<div class="post-metadata">

**Author:** ![xiaozhe\_shao](https://avatars.discourse-cdn.com/v4/letter/x/97f17d/32.png) [@xiaozhe\_shao](https://community.zeek.org/u/xiaozhe_shao)\
**Post date:** [February 9, 2016, 9:01pm UTC](https://community.zeek.org/t/cluster-bro-configuration/4002/3 "2016-02-09T21:01:12Z")

</div>

Thank you very much for your reply.  
Additionally, I want to know who splits the traffic into two parts. PF\_RING or Bro worker? Is there any introduction (maybe some webpage) about this functionality?

Best,  
-xiaozhe

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/cluster-bro-configuration/4002/4 "2022-05-06T15:43:23Z")

</div>