# Multiple Capture Interfaces
**URL:** https://community.zeek.org/t/multiple-capture-interfaces/1636
**Category:** Zeek
**Created:** [June 10, 2010, 8:17pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636 "2010-06-10T20:17:12Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Alan\_J\_Meeks](https://community.zeek.org/u/Alan_J_Meeks)
#### Post date: [June 10, 2010, 8:17pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/1 "2010-06-10T20:17:12Z")
I am a new user of Bro. I’ve installed ver 1.5.1 and I can run just fine with a single interface (whichever one is specified in node.cfg) but I can’t seem to get other capture interfaces running. I am set up with 4 ethernet interfaces, three of which are taps to different locations within my network and one to the local subnet where the server is located.
What additional information can I provide that might help identify the issue?
Alan Meeks
Information Security Analyst
Angelo State University
www.angelo.edu
325-942-2333 phone
325-942-2109 fax
---
### Author:  [@Sam\_Oehlert](https://community.zeek.org/u/Sam_Oehlert)
#### Post date: [June 10, 2010, 8:20pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/2 "2010-06-10T20:20:23Z")
What installation steps did you follow? I had problems getting a cluster up and running because I was installing it incorrectly at first.
Sam
---
### Author:  [@Alan\_J\_Meeks](https://community.zeek.org/u/Alan_J_Meeks)
#### Post date: [June 10, 2010, 8:24pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/3 "2010-06-10T20:24:28Z")
Sam,
I believe I installed in a non-clustered or standalone mode. Ran the ./configure, make and make install after ensuring I got all the prereqs on the server.
I also forgot to mention I was not in the position where I could pick and choose my hardware and could not get BSD installed. I had to fall back to CentOS 5.5.
Not sure if that answers your question.
---
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [June 10, 2010, 8:40pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/4 "2010-06-10T20:40:05Z")
How are you pointing Bro at the different interfaces?
Vern
---
### Author:  [@Alan\_J\_Meeks](https://community.zeek.org/u/Alan_J_Meeks)
#### Post date: [June 10, 2010, 8:49pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/5 "2010-06-10T20:49:16Z")
Well, I've tried the command line switch -i to specify multiple interfaces by starting bro with "bro -i eth0 -i eth1" and so on but when I try to start bro with that way it will not start. The command will hang and bro won't start. I can start bro through ./broctl but can't pass it the interfaces as parameters that way.
---
### Author:  [@William\_Jones](https://community.zeek.org/u/William_Jones)
#### Post date: [June 10, 2010, 10:10pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/6 "2010-06-10T22:10:26Z")
I run taps too and the use the following config perwork:
[worker-4]
#NLR
type=worker
host=homey1.tacc.utexas.edu
interface=eth4.3021 -i eth5.3021
aux\_scripts=q1
The aux\_scripts set up a filter so that worker only sees a portion of the ips space, in my cases ¼ per work per tap.
Bill Jones
---
### Author:  [@Alan\_J\_Meeks](https://community.zeek.org/u/Alan_J_Meeks)
#### Post date: [June 11, 2010, 2:04pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/7 "2010-06-11T14:04:33Z")
Bill,
Thank you. I had somehow missed that I could pass multiple interface arguments to broctl through the interface line in node.cfg that way. I’ve modified the interface line and bro is now capturing on all four interfaces simultaneously.
---
### Author:  [@William\_Jones](https://community.zeek.org/u/William_Jones)
#### Post date: [June 11, 2010, 2:54pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/8 "2010-06-11T14:54:45Z")
It easy to miss sense it’s an undocumented feature J
---
### Author:  [@seth](https://community.zeek.org/u/seth)
#### Post date: [June 11, 2010, 3:34pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/9 "2010-06-11T15:34:05Z")
Unfortunately, the reason it's undocumented is because (while it does work) it's not a recommended solution because it breaks several other features in broctl.
Better ways to accomplish the same thing are to..
1. Bridge your interfaces together in your operating system to present a single interface to Bro.
2. Run Bro as a cluster where each worker node runs on the same box but sniff different interfaces.
.Seth
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/multiple-capture-interfaces/1636/10 "2022-05-06T15:39:07Z")