problem of multi-interface monitor?

Zeek
1

Hello,
when i execute “bro -i eth0 -i eth1 login.bro”,bro only capture and deal with packets from eth0 and drop all from eth1.

“1103734623.487821:ContentGap:NOTICE_ALARM_ALWAYS::192.168.10.10:2422/tcp:192.168.10.77:23/tcp::::::192.168.10.10/2422 > 192.168.10.77/telnet content gap (> 69/11):”

after that,i emove “capture-filter …” fom login.bro and try again,bro can capture and do rightly.

why? and how can i solve this problem?

sorry,i am not familiar whit BRO.

2

What if you execute "bro -f '' ..." (which manually sets the filter to capture all packets)?

How about '-f "port telnet or tcp port 513"'?

Finally, without specifying the -f flag, what's the output if you print capture_filter in event bro_init()? Adding the following piece of code (to login.bro) will do:

event bro_init()
  {
  print fmt("%s", capture_filter);
  }

Ruoming