# Possible disable split\_routing detecting ?

**URL:** <https://community.zeek.org/t/possible-disable-split-routing-detecting/601>\
**Category:** Zeek\
**Created:** [September 29, 2004, 3:27am UTC](https://community.zeek.org/t/possible-disable-split-routing-detecting/601 "2004-09-29T03:27:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [September 29, 2004, 3:27am UTC](https://community.zeek.org/t/possible-disable-split-routing-detecting/601/1 "2004-09-29T03:27:43Z")

</div>

> I use bro,
> 
> but not have more 1 link to InterNet,
> 
> Possible disable split\_routing detecting/function ?

If it's not possible that you're seeing split routing, then it's important  
to figure out why Bro believes it's seeing it. You should capture a trace  
using -w for which Bro reports split routing; see if running on the trace  
off-line reproduces that message; and, if so, investigate the trace to  
determine whether in fact the given connection is missing part of its  
SYN/SYN-ACK pair.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/possible-disable-split-routing-detecting/601/2 "2022-05-06T15:37:11Z")

</div>


