[Bro] Multiple interfaces

Cuttler, Matt mcuttler at bnl.gov
Thu Jul 17 10:50:20 PDT 2008

> Greetings.
> Can bro (running as a single process) read packets (monitor traffic)
from multiple interfaces (say > eth0 and eth1) ?

That's more of an OS thing than a Bro thing. Assuming linux, you could
use the 'bonding' module ( http://www.linuxfoundation.org/en/Net:Bonding

You would then tell bro to use this device as your capture interface.

It's not uncommon to need more than one interface to collect (i.e. a
regen fibre tap).

-Matt Cuttler

More information about the Bro mailing list