‘eth0 -i eth1’ makes half of conn.log count than ‘eth0’

Hi everyone

I am having configure issue.

In node.cfg , ‘eth0 -i eth1’ config makes half of conn.log count than ‘eth0’

there is no traffic in eth1, in live monitoring eth1 is standby.

I test this live traffic and pfsend with pcap file from other server

(pfsend is feeding only to eth0 port)

Because of circumstances I can not use bridge setup.

I must be missing something.

Could any one point me to right direction?

My setup is blow

Zeek(bro) server

cpu: Intel(R) Xeon(R) CPU E5-2650 X 2 (total 32 core)

ram: 64G

zeek(bro) 2.4.2 with pf_ring 7.5.0 (not a zc)

no extra zeek(bro) script

server has two monitoring port

eth0(active), eth1 (standby)

node.cfg ‘eth0 -i eth1’

[manager]

type=manager

host=localhost

[proxy-1]

type=proxy

host=localhost

[proxy-2]

type=proxy

host=localhost

[monitor]

type=worker

host=localhost

interface=‘eth0 -i eth1’

lb_method=pf_ring

lb_procs=10

pin_cpus=1,2,3,4,5,6,7,8,9,10

node.cfg eth0

[manager]

type=manager

host=localhost

[proxy-1]

type=proxy

host=localhost

[proxy-2]

type=proxy

host=localhost

[monitor]

type=worker

host=localhost

interface=eth0

lb_method=pf_ring

lb_procs=10

pin_cpus=1,2,3,4,5,6,7,8,9,10