# Question about listening on multiple interfaces

**URL:** <https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762>\
**Category:** Zeek\
**Created:** [April 5, 2017, 5:09pm UTC](https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762 "2017-04-05T17:09:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![espressobeanies](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@espressobeanies](https://community.zeek.org/u/espressobeanies)\
**Post date:** [April 5, 2017, 5:09pm UTC](https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762/1 "2017-04-05T17:09:24Z")

</div>

Good afternoon,

I’m trying to see what would be the best way to direct Bro to listen on multiple interfaces. I currently have one interface defined in my node.cfg file but to add the second, is it best to create a separate worker or define the interface in broctl using ‘broargs’?

Thanks,

---

<div class="post-metadata">

**Author:** ![Samuel\_Oehlert](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@Samuel\_Oehlert](https://community.zeek.org/u/Samuel_Oehlert)\
**Post date:** [April 5, 2017, 11:48pm UTC](https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762/2 "2017-04-05T23:48:23Z")

</div>

I’ve always done a separate worker in that case, which I believe is the most common way, though I’m not sure if one way is correct vs incorrect, or just common vs uncommon.

-Sam

---

<div class="post-metadata">

**Author:** ![espressobeanies](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@espressobeanies](https://community.zeek.org/u/espressobeanies)\
**Post date:** [April 6, 2017, 3:54pm UTC](https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762/3 "2017-04-06T15:54:06Z")

</div>

I see. Yep. I confirmed I’m able to see traffic on both interfaces using the ‘broargs’ route. I’m not seeing much of a drop in resources or uptick in packet drops even with my node.cfg file defined to use ‘lb\_procs=myricom’ and the second interface not being a Myricom-based NIC. Dunno if it would cause efficiency loss but I’m not able to detect it.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/question-about-listening-on-multiple-interfaces/4762/4 "2022-05-06T15:44:48Z")

</div>