Multiple interfaces

Zeek
1

Greetings.

Can bro (running as a single process) read packets (monitor traffic)
from multiple interfaces (say eth0 and eth1) ?

Thanks

2

Greetings.

Can bro (running as a single process) read packets (monitor traffic)

from multiple interfaces (say > eth0 and eth1) ?

That's more of an OS thing than a Bro thing. Assuming linux, you could
use the 'bonding' module ( http://www.linuxfoundation.org/en/Net:Bonding
).

You would then tell bro to use this device as your capture interface.

It's not uncommon to need more than one interface to collect (i.e. a
regen fibre tap).

-Matt Cuttler

3

Besides the bonding technique that Matt mentioned, the bro binary accepts multiple "-i" flags for multiple interfaces.

  .Seth