# How to use PF\_RING multi? **URL:** \ **Category:** Zeek\ **Created:** [November 13, 2014, 6:05pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358 "2014-11-13T18:05:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\ **Post date:** [November 13, 2014, 6:05pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/1 "2014-11-13T18:05:37Z")
What is the configuration needed to run bro with PF\_RING using its link aggregation (multi) capability? This below (a snippet of node.cfg) doesn’t do it: [bro-pf] type=worker host=X.X.X.X interface=multi:em1;em2 lb\_method=pf\_ring lb\_procs=8 ---
**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\ **Post date:** [November 13, 2014, 6:18pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/2 "2014-11-13T18:18:30Z")
I found the answer. I missed the lb\_interfaces option. ---
**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\ **Post date:** [November 13, 2014, 6:22pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/3 "2014-11-13T18:22:06Z")
Wait, does lb\_interfaces work with lb\_method=pf\_ring? My bro instance didn’t complain when I started it, but I do not believe it is actually processing packets. ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [November 13, 2014, 6:37pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/4 "2014-11-13T18:37:57Z")
would you mind posting the full working config? I’m interested in this as well. Cheers, JB ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [November 13, 2014, 6:52pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/5 "2014-11-13T18:52:26Z")
[https://github.com/jsiwek/sshd\_audit\_mux](https://github.com/jsiwek/sshd_audit_mux) ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [November 13, 2014, 7:22pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/6 "2014-11-13T19:22:32Z")
I'm wondering the same thing... It would make pooling resources for multi nic'd bro works a ton easier... Has anyone done this? Can it be done? Cheers, JB ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 13, 2014, 8:17pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/7 "2014-11-13T20:17:28Z")
I'm afraid we don't have a terribly elegant method to do that with PF\_Ring right now. You could use their ZC module and do the load balancing in userspace with their zbalance\_ipc tool (or whatever it's called). I think that can merge traffic and distribute it out and we support sniffing from ZC load balanced interfaces. This is yet another area where our upcoming packet-bricks tool will make life easier. I just wish it was ready for people to generally use. 😕   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3358/8 "2022-05-06T15:42:14Z")
Closed on May 6, 2022, 3:42pm UTC