# node.cfg multiple interface convention?

**URL:** <https://community.zeek.org/t/node-cfg-multiple-interface-convention/4378>\
**Category:** Zeek\
**Created:** [September 29, 2016, 7:10pm UTC](https://community.zeek.org/t/node-cfg-multiple-interface-convention/4378 "2016-09-29T19:10:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Harwood](https://avatars.discourse-cdn.com/v4/letter/c/f08c70/32.png) [@Chris\_Harwood](https://community.zeek.org/u/Chris_Harwood)\
**Post date:** [September 29, 2016, 7:10pm UTC](https://community.zeek.org/t/node-cfg-multiple-interface-convention/4378/1 "2016-09-29T19:10:38Z")

</div>

Hi all,

One of my installations runs on an old linux laptop monitoring wifi traffic exclusively in standalone.

I’m wondering what the convention is for node.cfg to add monitoring to the wired interface as well.

The use case is, the system is taken off the wifi and restarted at a second location for monitoring a wired connection.

Is the following node.cfg valid?

[bro]  
type=standalone  
host=localhost  
interface=wlan0  
interface=eth0

Or is a better configuration to use 2 workers, one for each interface?

Thanks in advance,

Chris

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [September 30, 2016, 9:05pm UTC](https://community.zeek.org/t/node-cfg-multiple-interface-convention/4378/2 "2016-09-30T21:05:25Z")

</div>

Hello Chris,

no, the given node.cfg is not valid, you can only specify one interface  
for a standalone node. The best solution would probably be to use 2  
workers, one for each interface. There is a workaround that should still  
work, where you give the interface as "wlan0 -i eth0", (see  
[https://bro-tracker.atlassian.net/browse/BIT-12](https://bro-tracker.atlassian.net/browse/BIT-12)), which I think still  
works, but that might break anytime.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/node-cfg-multiple-interface-convention/4378/3 "2022-05-06T15:44:05Z")

</div>

Closed on May 6, 2022, 3:44pm UTC