# Two instances of bro on the same host? **URL:** \ **Category:** Zeek\ **Created:** [November 25, 2019, 7:49pm UTC](https://community.zeek.org/t/two-instances-of-bro-on-the-same-host/5914 "2019-11-25T19:49:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Erich\_M\_Nahum](https://avatars.discourse-cdn.com/v4/letter/e/958977/32.png) [@Erich\_M\_Nahum](https://community.zeek.org/u/Erich_M_Nahum)\ **Post date:** [November 25, 2019, 7:49pm UTC](https://community.zeek.org/t/two-instances-of-bro-on-the-same-host/5914/1 "2019-11-25T19:49:11Z")
Howdy, I have a multi-core machine listening to 8 interfaces with zeek. I’m using the kafka plugin to send logs to individual topics (conn, dns, http, etc). I’ve recently gotten a tap outside the firewall and want to send the equivalent logs to different comparable topics (conn-firewall, dns-firewall, etc). I’m currently using zeekctl with multiple workers. What I’m wondering is can I use two instances of zeekctl on the same machine, one for inside the FW and one for outside. It’s not an option right now to do the outside the FW on a separate machine. Any suggestions? Thanks, -Erich ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [November 25, 2019, 8:55pm UTC](https://community.zeek.org/t/two-instances-of-bro-on-the-same-host/5914/2 "2019-11-25T20:55:24Z")
I use one bro instance to listen to both internal and external. Set your filters in your SIEM to internal vs. external networks and you should be fine. James ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/two-instances-of-bro-on-the-same-host/5914/3 "2022-05-06T15:46:54Z")