[Oisf-users] Capturing single Port-channel on multiple interfaces, cluster-id

[Peter Manev]

On Tue, Nov 3, 2015 at 8:01 PM, Kazimiarovich, Gene
<gene.kazimiarovich at westernsouthernlife.com> wrote:
>
>
> What is the cluster-id setting for capturing four interfaces bundled into a
> single Port-channel, same or different for each interface?
>

The cluster-id should be unique/different - for each interface
configuration in suricata.yaml

>
>
> What are the recommended use cases for same cluster-id?
>
>
>
>
>
>
>
>



-- 
Regards,
Peter Manev