I’m using PF_RING as LB for bro. 4-tuple works pretty well for me before I start to work with FTP protocol. I found that the command channel and data channel are balanced to different bro workers which cause ftp data cannot be handled properly. It can be resolved by using 2-tuple as pfring cluster type. However, using 2-tuple cause the load to different workers is not even especially for the case that one IP has a peak time to the same dest ip. Is there a better solution to cope with this? Thanks.