# How to use PF\_RING multi?

**URL:** <https://community.zeek.org/t/how-to-use-pf-ring-multi/3361>\
**Category:** Zeek\
**Created:** [November 17, 2014, 11:04pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3361 "2014-11-17T23:04:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [November 17, 2014, 11:04pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3361/1 "2014-11-17T23:04:46Z")

</div>

I have not yet tried zbalance (I will someday) because I¹m now told that  
the packet stream is flow balanced upstream of the sensor. Each interface  
(em1 and em2) will get bi-directional flows. Each will get half of the  
total flows. So, can I have separate Bro pf\_ring configs for each  
interface? That is, will the below node.cfg work? It is starting 8 worker  
procs as expected, but I¹m not sure whether bro is doing what I think it  
would with this config.

[manager]  
type=manager  
host=10.0.0.1

[proxy-1]  
type=proxy  
host=10.0.0.1

[bro-em1]  
type=worker  
host=10.0.0.1  
interface=zc:em1  
lb\_method=pf\_ring  
lb\_procs=4

[bro-em2]  
type=worker  
host=10.0.0.1  
interface=zc:em2  
lb\_method=pf\_ring  
lb\_procs=4

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/how-to-use-pf-ring-multi/3361/2 "2022-05-06T15:42:14Z")

</div>

Closed on May 6, 2022, 3:42pm UTC