# FTP with PF\_RING

**URL:** https://community.zeek.org/t/ftp-with-pf-ring/4932
**Category:** Zeek
**Created:** [July 8, 2017, 6:07am UTC](https://community.zeek.org/t/ftp-with-pf-ring/4932 "2017-07-08T06:07:05Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![duhang](https://avatars.discourse-cdn.com/v4/letter/d/bbce88/32.png) [@duhang](https://community.zeek.org/u/duhang)
#### Post date: [July 8, 2017, 6:07am UTC](https://community.zeek.org/t/ftp-with-pf-ring/4932/1 "2017-07-08T06:07:05Z")

</div>

Hello,

I’m using PF\_RING as LB for bro. 4-tuple works pretty well for me before I start to work with FTP protocol. I found that the command channel and data channel are balanced to different bro workers which cause ftp data cannot be handled properly. It can be resolved by using 2-tuple as pfring cluster type. However, using 2-tuple cause the load to different workers is not even especially for the case that one IP has a peak time to the same dest ip. Is there a better solution to cope with this? Thanks.

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/ftp-with-pf-ring/4932/2 "2022-05-06T15:45:06Z")

</div>


