Why does zeek not analyze mirror traffic?

Zeek
1

Hello!
I’m new to zeek and recently ran into a problem I couldn’t solve.
I installed zeek, PF-RING, and AF_PACKET on a superior server,When I use zeek to analyze my local traffic in real time, it works.
This is the content of notice.log file.

1
11081×635 199 KB

zeek did analyze the burst traffic I was generating.
However, when I mirrored the traffic of the other two network segments, zeek could not analyze the burst traffic. At first, I thought that the traffic was too large. However, I only mirrored the traffic of one network segment and zeek could not analyze the burst traffic.
This is the content of the notice.log file for the connection image port.

2
21331×299 42.3 KB

What confused me was that I could see ssh traffic I was generating in ssh.log.

3
31500×604 333 KB

I also tried to connect the mirrored traffic directly to my physical network card and found that the problem still occurred, as did the offline packets.

2

Hi,

problems like these are really hard for us to debug since there are a lot of different things that can go wrong. I would start by creating a pcap of the traffic and see if that works, or if that already fails.

Johanna