# Multiple interfaces

**URL:** <https://community.zeek.org/t/multiple-interfaces/1363>\
**Category:** Zeek\
**Created:** [July 17, 2008, 4:59pm UTC](https://community.zeek.org/t/multiple-interfaces/1363 "2008-07-17T16:59:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adayadil\_Thomas](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Adayadil\_Thomas](https://community.zeek.org/u/Adayadil_Thomas)\
**Post date:** [July 17, 2008, 4:59pm UTC](https://community.zeek.org/t/multiple-interfaces/1363/1 "2008-07-17T16:59:20Z")

</div>

Greetings.

Can bro (running as a single process) read packets (monitor traffic)  
from multiple interfaces (say eth0 and eth1) ?

Thanks

---

<div class="post-metadata">

**Author:** ![Cuttler\_Matt](https://avatars.discourse-cdn.com/v4/letter/c/c0e974/32.png) [@Cuttler\_Matt](https://community.zeek.org/u/Cuttler_Matt)\
**Post date:** [July 17, 2008, 5:50pm UTC](https://community.zeek.org/t/multiple-interfaces/1363/2 "2008-07-17T17:50:20Z")

</div>

> Greetings.
> 
> Can bro (running as a single process) read packets (monitor traffic)

from multiple interfaces (say \> eth0 and eth1) ?

That's more of an OS thing than a Bro thing. Assuming linux, you could  
use the 'bonding' module ( [http://www.linuxfoundation.org/en/Net:Bonding](http://www.linuxfoundation.org/en/Net:Bonding)  
).

You would then tell bro to use this device as your capture interface.

It's not uncommon to need more than one interface to collect (i.e. a  
regen fibre tap).

-Matt Cuttler

---

<div class="post-metadata">

**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\
**Post date:** [July 17, 2008, 6:30pm UTC](https://community.zeek.org/t/multiple-interfaces/1363/3 "2008-07-17T18:30:48Z")

</div>

Besides the bonding technique that Matt mentioned, the bro binary accepts multiple "-i" flags for multiple interfaces.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/multiple-interfaces/1363/4 "2022-05-06T15:38:36Z")

</div>