Bro Digest, Vol 152, Issue 15


I’m not sure if you got what you were looking for or if this input of mine will help, but I use the “worker” tag to help me identify which interface the logged event was seen on. The events in the conn log show the worker name for the event seen when logging. There is also a unique number for each process so in the below node.cfg example the logs would include a field that states “worker-1-1”, “worker-1-2”, “worker-2-1”, or “worker-2-2”. When I see worker-1 in the log I know it was seen on eth1 and when I see worker-2 in the log I know it was seen on eth2.

Hope this helped.

Example node.cfg: