problem of multi-interface monitor?

when i execute “bro -i eth0 -i eth1 login.bro”,bro only capture and deal with packets from eth0 and drop all from eth1.

“1103734623.487821:ContentGap:NOTICE_ALARM_ALWAYS:: > content gap (> 69/11):”

after that,i emove “capture-filter …” fom login.bro and try again,bro can capture and do rightly.

why? and how can i solve this problem?

sorry,i am not familiar whit BRO.

What if you execute "bro -f '' ..." (which manually sets the filter to capture all packets)?

How about '-f "port telnet or tcp port 513"'?

Finally, without specifying the -f flag, what's the output if you print capture_filter in event bro_init()? Adding the following piece of code (to login.bro) will do:

event bro_init()
  print fmt("%s", capture_filter);