I use bro,
but not have more 1 link to InterNet,
Possible disable split_routing detecting/function ?
If it's not possible that you're seeing split routing, then it's important
to figure out why Bro believes it's seeing it. You should capture a trace
using -w for which Bro reports split routing; see if running on the trace
off-line reproduces that message; and, if so, investigate the trace to
determine whether in fact the given connection is missing part of its
SYN/SYN-ACK pair.
Vern