ERROR: Only a single interface option (-i) is allowed.
I didn't have this issue with 2. Any reason why only one interface is allowed now? Unless something radical has changed with the resources that zeekctl uses I have no desire to use it. I'm dead in the water with Zeek as of now. Thank you.
If you don’t really need the latest and greatest cutting edge changes to 3.1, version 3.0.x still supports multiple interfaces. That feature was removed in 3.1 due to the wide changes to the IO Loop architecture, and you’re honestly the first user I’ve heard from that has noticed it missing. It was removed to make that work easier to accomplish, but we can certainly investigate bringing it back if there’s enough of a use case for it.
If you don’t really need the latest and greatest cutting edge changes to 3.1, version 3.0.x still supports multiple interfaces. That feature was removed in 3.1 due to the wide changes to the IO Loop architecture, and you’re honestly the first user I’ve heard from that has noticed it missing. It was removed to make that work easier to accomplish, but we can certainly investigate bringing it back if there’s enough of a use case for it.
Another option, I think would be to bond/bridge the interfaces and listen on that. If that would work for you,
Appreciate the responses. These interfaces are an external on the internet, and an internal with a localnet (this devices is classified as router), so bonding them isn't an option. The only reason I'm running in this manner as apposed to just letting zeekctl handle it all is the process count and memory usage. I guess I'll test out zeekctl and see where I sit....might have to fallback to 3.0. Thank you.
Oh hah, I don’t need any credit for all of that work. I had an old patch against 2.4/5/6 that would relax the polling loop interval so it wouldn’t eat up a lot of cpu on smaller devices, but it wasn’t a fix. Tim completely rewrote the IO loop so now zeek on a raspberry pi should use 0% cpu when there’s no traffic.
could you please detail a little bit how you are currently running Zeek.
Since it sounds like you are handling a lot of traffic - you typically should already have to run zeek in cluster mode using zeekctl/broctl. At which point this problem does not apply anymore - since in a cluster you can have a zeek process (or - typically - several zeek processes) for each interface.
If you are currently running a single standalone zeek process on several 10G interfaces - did you check your packet loss? Because it seems unlikely to me that this setup is not loosing a ton of traffic.