I’m not sure this is a bug, which is why I didn’t post it on the tracker. In 2.1 one could do this in node.cfg:
interface=eth2 -i eth3
And bro would open both interfaces. In 2.2-beta-4 specifying two -i’s while manually running bro works, but trying to do the above with the “interface” specification doesn’t, giving this error:
fatal error: /usr/local/bro/bin/bro: problem with interface eth2 -i eth3 - pcap_open_live: eth2 -i eth3: No such device exists (SIOCGIFHWADDR: No such device)
Looks like it’s not parsing things the same way. In 2.2 will there be a new way to specify multiple interfaces?