Question about listening on multiple interfaces

Zeek
1

Good afternoon,

I’m trying to see what would be the best way to direct Bro to listen on multiple interfaces. I currently have one interface defined in my node.cfg file but to add the second, is it best to create a separate worker or define the interface in broctl using ‘broargs’?

Thanks,

2

I’ve always done a separate worker in that case, which I believe is the most common way, though I’m not sure if one way is correct vs incorrect, or just common vs uncommon.

-Sam

3

I see. Yep. I confirmed I’m able to see traffic on both interfaces using the ‘broargs’ route. I’m not seeing much of a drop in resources or uptick in packet drops even with my node.cfg file defined to use ‘lb_procs=myricom’ and the second interface not being a Myricom-based NIC. Dunno if it would cause efficiency loss but I’m not able to detect it.