# how to get not duplicated packets

**URL:** <https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280>\
**Category:** Zeek\
**Created:** [April 27, 2018, 9:47am UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280 "2018-04-27T09:47:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seong\_Hyeok\_Seo](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@Seong\_Hyeok\_Seo](https://community.zeek.org/u/Seong_Hyeok_Seo)\
**Post date:** [April 27, 2018, 9:47am UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/1 "2018-04-27T09:47:39Z")

</div>

> Hi, we’re doing a job that collecting traffic by using Bro and PF\_RING

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)\
**Post date:** [April 27, 2018, 2:33pm UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/2 "2018-04-27T14:33:37Z")

</div>

Could you provide a bit more detail about your setup? Are the workers all running on a single server, or are they distributed across multiple servers?

What I’m trying to determine is at what point the duplication is happening.

---

<div class="post-metadata">

**Author:** ![Seong\_Hyeok\_Seo](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@Seong\_Hyeok\_Seo](https://community.zeek.org/u/Seong_Hyeok_Seo)\
**Post date:** [April 27, 2018, 2:56pm UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/3 "2018-04-27T14:56:20Z")

</div>

Yes, I will do that.

---

<div class="post-metadata">

**Author:** ![Mark\_Buchanan](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Mark\_Buchanan](https://community.zeek.org/u/Mark_Buchanan)\
**Post date:** [April 27, 2018, 5:22pm UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/4 "2018-04-27T17:22:08Z")

</div>

From of one of Justin’s posts a while back (as I have struggled with this numerous times) - this may or may not be the issue, but putting it out there if it is as it has the same symptoms.

[root@bro-dev ~]# broctl config | grep pfring  
pfringclusterid = 21  
pfringclustertype = 4-tuple  
ringfirstappinstance = 0

if you have pfringclusterid set to 0, that’s the problem that was just fixed. You can easily workaround that by adding

PFRINGClusterID = 21

to your /usr/local/bro/etc/broctl.cfg

Mark

---

<div class="post-metadata">

**Author:** ![Seong\_Hyeok\_Seo](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@Seong\_Hyeok\_Seo](https://community.zeek.org/u/Seong_Hyeok_Seo)\
**Post date:** [April 30, 2018, 1:08am UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/5 "2018-04-30T01:08:59Z")

</div>

thanks a lot, Mark!  
it’s solved by adding “PFRINGClusterID = 21” in the cfg file.  
it works well!

2018년 4월 28일 토요일, Mark Buchanan\<[mabuchan@gmail.com](mailto:mabuchan@gmail.com)\>님이 작성한 메시지:

---

<div class="post-metadata">

**Author:** ![Drew\_Dixon](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Drew\_Dixon](https://community.zeek.org/u/Drew_Dixon)\
**Post date:** [May 10, 2018, 12:32am UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/6 "2018-05-10T00:32:32Z")

</div>

You should also probably configure a logger process in node.cfg to run on on the same box as your manager and proxy.

-Drew

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/how-to-get-not-duplicated-packets/5280/7 "2022-05-06T15:45:44Z")

</div>