I am running Bro on my MacBook.
I usually use wifi, but sometimes use either a USB or Thunderbolt network adapter and I’d like Bro to monitor whatever interface I am using, but am running into some problems.
My wifi is en0
USB network adapter is en3
Thunderbolt Ethernet is en5
In node.cfg I have interface=en0
In broctl.cfg I have broargs = -i en3 -i en5
This seems to be working as long as the USB network adapter and the Thunderbolt network adapter are physically connected. But when one of them is not connected the interface does not exist and Bro will not start — error: fatal error: /opt/bro/bin/bro: problem with interface en5 - pcap_open_live: en5: No such device exists (BIOCSETIF failed: Device not configured) when the Thunderbolt adapter is not connected.
Is there a way to tell Bro to monitor an interface if it exists, but ignore it otherwise? Or is there a way to force my Mac to keep the en3/en5 devices available even when the USB/Thunderbolt network adapters are not attached? Or is there a better way to accomplish what I am trying to do?
Jeff