[Bro] problem of multi-interface monitor?

亮 李 gefonty at yahoo.com.cn
Wed Dec 22 09:42:09 PST 2004

when i execute "bro -i eth0 -i eth1 login.bro",bro only capture and deal with packets from eth0 and drop all from eth1.
"1103734623.487821:ContentGap:NOTICE_ALARM_ALWAYS::         > content gap (> 69/11):"
after that,i emove "capture-filter ......" fom login.bro and try again,bro can capture and do rightly.
why? and how can i solve this problem?
sorry,i am not familiar whit BRO.

Do You Yahoo!?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041223/c14e2e2d/attachment.html 

More information about the Bro mailing list