Identifying interface when running with multiple interfaces

Zeek
1

Hey all,

So I run bro with:

/usr/local/bin/bro --no-checksums -i eth0 -i ppp0 local
"Site::local_nets += { x.x.x.x/32,192.168.1.0/24 }" &

Is there something I can do to add a field that would let me know which
interface the traffic came in on? Obviously in this example it's pretty
simple...private IP space will be on eth0 whereas public will be on
ppp0. I am thinking of scenarios where there might be the same IP space
on several interfaces. Thanks for any guidance.

James

2

Nope, sorry. I would recommend running this as a cluster with two workers. One sniffing each interface. This is how SecurityOnion approaches this issue.

  .Seth

3

Thanks Seth...does clustering require using broctl?

James