I have not yet tried zbalance (I will someday) because I¹m now told that
the packet stream is flow balanced upstream of the sensor. Each interface
(em1 and em2) will get bi-directional flows. Each will get half of the
total flows. So, can I have separate Bro pf_ring configs for each
interface? That is, will the below node.cfg work? It is starting 8 worker
procs as expected, but I¹m not sure whether bro is doing what I think it
would with this config.
[manager]
type=manager
host=10.0.0.1
[proxy-1]
type=proxy
host=10.0.0.1
[bro-em1]
type=worker
host=10.0.0.1
interface=zc:em1
lb_method=pf_ring
lb_procs=4
[bro-em2]
type=worker
host=10.0.0.1
interface=zc:em2
lb_method=pf_ring
lb_procs=4