netmap lb behavior

[roozbehk]

We are running Zeek and Suricata on a same node, I was wondering if this is a expected behavior with lb where in order for second service to recieve traffic, the first service needs to be running.

we are running FreeBSD 15 with netmap lb running on the node using the below command.

/usr/local/bin/lb -i ixl0 -p suricata_ixl0:12 -p zeek_ixl0:12

I have noticed if suricata is not running, zeek will not receive any traffic; once suricata is started zeek also receives traffic.

[awelzel]

Hey @roozbehk - IIRC that makes sense. Here's a link to some code that appears to confirm your observation.

You're more likely to get the right and authoritative answer over in the netmap repo if you want to check there, too.

Have fun! :-)