Why does zeek not analyze mirror traffic?

I’m new to zeek and recently ran into a problem I couldn’t solve.
I installed zeek, PF-RING, and AF_PACKET on a superior server,When I use zeek to analyze my local traffic in real time, it works.
This is the content of notice.log file.

zeek did analyze the burst traffic I was generating.
However, when I mirrored the traffic of the other two network segments, zeek could not analyze the burst traffic. At first, I thought that the traffic was too large. However, I only mirrored the traffic of one network segment and zeek could not analyze the burst traffic.
This is the content of the notice.log file for the connection image port.

What confused me was that I could see ssh traffic I was generating in ssh.log.

I also tried to connect the mirrored traffic directly to my physical network card and found that the problem still occurred, as did the offline packets.


problems like these are really hard for us to debug since there are a lot of different things that can go wrong. I would start by creating a pcap of the traffic and see if that works, or if that already fails.