# Identifying interface when running with multiple interfaces

**URL:** <https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200>\
**Category:** Zeek\
**Created:** [July 25, 2014, 11:42pm UTC](https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200 "2014-07-25T23:42:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [July 25, 2014, 11:42pm UTC](https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200/1 "2014-07-25T23:42:15Z")

</div>

Hey all,

So I run bro with:

/usr/local/bin/bro --no-checksums -i eth0 -i ppp0 local  
"Site::local\_nets += { x.x.x.x/32,192.168.1.0/24 }" &

Is there something I can do to add a field that would let me know which  
interface the traffic came in on? Obviously in this example it's pretty  
simple...private IP space will be on eth0 whereas public will be on  
ppp0. I am thinking of scenarios where there might be the same IP space  
on several interfaces. Thanks for any guidance.

James

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [July 26, 2014, 4:32am UTC](https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200/2 "2014-07-26T04:32:27Z")

</div>

Nope, sorry. I would recommend running this as a cluster with two workers. One sniffing each interface. This is how SecurityOnion approaches this issue.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [July 26, 2014, 12:37pm UTC](https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200/3 "2014-07-26T12:37:02Z")

</div>

Thanks Seth...does clustering require using broctl?

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/identifying-interface-when-running-with-multiple-interfaces/3200/4 "2022-05-06T15:41:56Z")

</div>