# Have a cluster infrastructure read pcaps

**URL:** <https://community.zeek.org/t/have-a-cluster-infrastructure-read-pcaps/4447>\
**Category:** Zeek\
**Created:** [October 30, 2016, 8:53am UTC](https://community.zeek.org/t/have-a-cluster-infrastructure-read-pcaps/4447 "2016-10-30T08:53:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [October 30, 2016, 8:53am UTC](https://community.zeek.org/t/have-a-cluster-infrastructure-read-pcaps/4447/1 "2016-10-30T08:53:24Z")

</div>

Hi all,

I have an issue with processing multiple pcap files in bro.  
Due to the fact that loading all of bro’s scripts and infrastructure is a time consuming task,

processing each pcap file takes longer than it should.

Is there any way that a bro cluster could be up and running and have it’s workers process the pcap files ?

btw, it needs to be a pcap file and not live capture using tcpreplay for transmitting them because of time issues (some sessions might be very long and bro will process the pcap file faster than retransmitting the same pcap file).

If anyone can think of a better way to accomplish it, I am free for offers 🙂

Thanks,

Bill

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/have-a-cluster-infrastructure-read-pcaps/4447/2 "2022-05-06T15:44:13Z")

</div>

Closed on May 6, 2022, 3:44pm UTC