# How to configure multiple interfaces

**URL:** <https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826>\
**Category:** Zeek\
**Created:** [September 3, 2019, 1:30am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826 "2019-09-03T01:30:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![raphael98](https://avatars.discourse-cdn.com/v4/letter/r/bbce88/32.png) [@raphael98](https://community.zeek.org/u/raphael98)\
**Post date:** [September 3, 2019, 1:30am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/1 "2019-09-03T01:30:10Z")

</div>

Hi,

I am installing Bro on Redhat OS.

My Bro machine has two interfaces.

- Interface#1(p1p1) : Server farm **inbound** traffic
- Interface#2(p1p2) : Server farm **outbound** traffic

I configured two interfaces with pf\_ring.

node.cfg file is as follows.

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [September 3, 2019, 1:39am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/2 "2019-09-03T01:39:30Z")

</div>

Install [https://github.com/ntop/bro-pf\_ring](https://github.com/ntop/bro-pf_ring) in general for best results.

Use

interface=pf\_ring::p1p1,p1p2

---

<div class="post-metadata">

**Author:** ![raphael98](https://avatars.discourse-cdn.com/v4/letter/r/bbce88/32.png) [@raphael98](https://community.zeek.org/u/raphael98)\
**Post date:** [September 3, 2019, 5:50am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/3 "2019-09-03T05:50:34Z")

</div>

Thanks.

Your words helped me a lot.

2019년 9월 3일 (화) 오전 10:40, Justin Azoff \<[justin@corelight.com](mailto:justin@corelight.com)\>님이 작성:

---

<div class="post-metadata">

**Author:** ![Xavier\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/x/b9e5f3/32.png) [@Xavier\_Gonzalez](https://community.zeek.org/u/Xavier_Gonzalez)\
**Post date:** [September 3, 2019, 8:20am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/4 "2019-09-03T08:20:57Z")

</div>

Hi Justin and Raphael,

Very good point and very interesting issue. Some questions….

What does exactly do bro-pf\_ring?

What does “best results” mean?

Is it mandatory to use bro + pf\_ring?

If not what features are added?

Thanks in advance,

Xavier Gonzalez

CTO & Co-founder

[http://opennac.org](https://urldefense.proofpoint.com/v2/url?u=http-3A__opencloudfactory.com_&d=DwMGaQ&c=57MOrb6NxZaYVa4uifS2UQ&r=7STsfyeMyac_1IFIgIS-WjdEirYO1GtwQ7VrUHTtpro&m=T67RemaYW12KUf2SFwdenG64ItIBu5RK6K_Iw51jv2U&s=-eQ9-r22Kp9xiDrpGjPtHV9AfU7tpjiF3EVDFkpQTm8&e=)

[http://opencloudfactory.com](https://urldefense.proofpoint.com/v2/url?u=http-3A__opencloudfactory.com_&d=DwMGaQ&c=57MOrb6NxZaYVa4uifS2UQ&r=7STsfyeMyac_1IFIgIS-WjdEirYO1GtwQ7VrUHTtpro&m=T67RemaYW12KUf2SFwdenG64ItIBu5RK6K_Iw51jv2U&s=-eQ9-r22Kp9xiDrpGjPtHV9AfU7tpjiF3EVDFkpQTm8&e=)

follow us: [@opennac](https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_opennac&d=DwMGaQ&c=57MOrb6NxZaYVa4uifS2UQ&r=7STsfyeMyac_1IFIgIS-WjdEirYO1GtwQ7VrUHTtpro&m=T67RemaYW12KUf2SFwdenG64ItIBu5RK6K_Iw51jv2U&s=Ue3qSgS7Wi6D-MiqHN_1d9FvO2A8XphTHeO9wdDIWwI&e=) [@viapps](https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_viapps&d=DwMGaQ&c=57MOrb6NxZaYVa4uifS2UQ&r=7STsfyeMyac_1IFIgIS-WjdEirYO1GtwQ7VrUHTtpro&m=T67RemaYW12KUf2SFwdenG64ItIBu5RK6K_Iw51jv2U&s=8TMKueanTMJrW8fDMeZ89hkHjOkTQAJTL0hWy8A9rN0&e=)

---

<div class="post-metadata">

**Author:** ![user6](https://avatars.discourse-cdn.com/v4/letter/u/f1d935/32.png) [@user6](https://community.zeek.org/u/user6)\
**Post date:** [September 3, 2019, 8:42am UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/5 "2019-09-03T08:42:16Z")

</div>

Guys, remove me from this, please. IDK how to stop recieving your emails about Bro.  
Thanks.  
3 сент. 2019 г., 4:32 +0300, Raphael Shin \<[hkshin98@gmail.com](mailto:hkshin98@gmail.com)\>, писал:

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [September 3, 2019, 2:48pm UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/6 "2019-09-03T14:48:16Z")

</div>

You can unsubscribe here: [http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek](http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/how-to-configure-multiple-interfaces/5826/7 "2022-05-06T15:46:44Z")

</div>


