# Bro 2.1 support for sniffing on multiple interfaces faces **URL:** \ **Category:** Zeek\ **Created:** [April 29, 2014, 10:46am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088 "2014-04-29T10:46:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Coen\_Bakkers](https://avatars.discourse-cdn.com/v4/letter/c/6bbea6/32.png) [@Coen\_Bakkers](https://community.zeek.org/u/Coen_Bakkers)\ **Post date:** [April 29, 2014, 10:46am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/1 "2014-04-29T10:46:56Z")
Does Bro 2.1 support sniffing on several interfaces at the same time? I have tried this now on a dozen of nodes, and the behavior does not seem to be consistent. Note that I am not trying to sniff an outbound and an inbound stream that are related, but I have a tap port on a separate network that I also interested in in covering. Sometimes multiple interfaces in node.cfg will work, but sometimes it makes Bro just hang and not record any of the http, dns, ftp logs etc.. ---
**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\ **Post date:** [April 29, 2014, 11:03am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/2 "2014-04-29T11:03:21Z")
Hi Coen, Are you perhaps using PF\_RING? [https://bro-tracker.atlassian.net/browse/BIT-943](https://bro-tracker.atlassian.net/browse/BIT-943) The PF\_RING multiple interface issue was resolved in Bro 2.2. ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 29, 2014, 11:05am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/3 "2014-04-29T11:05:04Z")
I have had great success with starting bro with: bro -i eth0 -i eth1 I am not using broctl. James ---
**Author:** ![Coen\_Bakkers](https://avatars.discourse-cdn.com/v4/letter/c/6bbea6/32.png) [@Coen\_Bakkers](https://community.zeek.org/u/Coen_Bakkers)\ **Post date:** [April 29, 2014, 11:08am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/4 "2014-04-29T11:08:10Z")
Hi Doug, I am not using PF\_RING, for now we have [bro] type=standalone host=localhost interface=eth0 interface=eth1 interface=eth2 interface=eth3 interface=eth5 interface=eth6 Where I am noticing that when leaving all of these interfaces enabled it may or may not break its working for some reason. When I switched to a single interface it started working but the configuration one of the nodes with above settings seems to works though and I have no clue why. Regards, Coen ---
**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\ **Post date:** [April 29, 2014, 11:16am UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/5 "2014-04-29T11:16:40Z")
I think type=standalone only supports one interface. Have you tried replacing the standalone config with a clustered config? [https://github.com/bro/broctl/blob/master/etc/node.cfg](https://github.com/bro/broctl/blob/master/etc/node.cfg) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-2-1-support-for-sniffing-on-multiple-interfaces-faces/3088/6 "2022-05-06T15:41:44Z")