# Filtering traffic by worker in cluster environments

**URL:** <https://community.zeek.org/t/filtering-traffic-by-worker-in-cluster-environments/6339>\
**Category:** Zeek\
**Created:** [May 12, 2021, 6:53am UTC](https://community.zeek.org/t/filtering-traffic-by-worker-in-cluster-environments/6339 "2021-05-12T06:53:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![clopmz](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@clopmz](https://community.zeek.org/u/clopmz)\
**Post date:** [May 12, 2021, 6:53am UTC](https://community.zeek.org/t/filtering-traffic-by-worker-in-cluster-environments/6339/1 "2021-05-12T06:53:11Z")

</div>

Hi all,

I have detected a behaviour in my Zeek cluster that I would like to avoid, if it is possible. I am using Zeek 4.0.1 under FreeBSD 13.

The problem comes because Zeek detects multiple duplicate packages, as reported to me by bro-doctor:

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [May 13, 2021, 2:57pm UTC](https://community.zeek.org/t/filtering-traffic-by-worker-in-cluster-environments/6339/2 "2021-05-13T14:57:47Z")

</div>

Cluster vs. Standalone isn't really the problem. However you run the  
workers, you're going to see the net1\<-\>net2 traffic in two places.

You can use this option in node.cfg to tell a certain set of workers  
to load different scripts:

aux\_scripts (string) Any node-specific Zeek script configured for this node.

Those scripts can then use the stuff in the PacketFilter module to  
filter the redundant traffic.

For 3 networks you have 3 total net\<-\>net links: net1\<-\>net2,  
net2\<-\>net3, net3\<-\>net1. For each of these pairs you need to decide  
which set of workers should log the traffic, and which should ignore  
it. Can probably keep it simply by doing something like:

net1\<-\>net2 capture on net1 workers, filter on net2  
net2\<-\>net3 capture on net2 workers, filter on net3  
net3\<-\>net1 capture on net3 workers, filter on net1

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/filtering-traffic-by-worker-in-cluster-environments/6339/3 "2022-05-06T15:47:39Z")

</div>