Hi all,
I have detected a behaviour in my Zeek cluster that I would like to avoid, if it is possible. I am using Zeek 4.0.1 under FreeBSD 13.
The problem comes because Zeek detects multiple duplicate packages, as reported to me by bro-doctor:
Cluster vs. Standalone isn't really the problem. However you run the
workers, you're going to see the net1<->net2 traffic in two places.
You can use this option in node.cfg to tell a certain set of workers
to load different scripts:
aux_scripts (string) Any node-specific Zeek script configured for this node.
Those scripts can then use the stuff in the PacketFilter module to
filter the redundant traffic.
For 3 networks you have 3 total net<->net links: net1<->net2,
net2<->net3, net3<->net1. For each of these pairs you need to decide
which set of workers should log the traffic, and which should ignore
it. Can probably keep it simply by doing something like:
net1<->net2 capture on net1 workers, filter on net2
net2<->net3 capture on net2 workers, filter on net3
net3<->net1 capture on net3 workers, filter on net1