[Bro] Question about listening on multiple interfaces

Espresso Beanies espressobeanies at gmail.com
Thu Apr 6 08:54:06 PDT 2017

I see. Yep. I confirmed I'm able to see traffic on both interfaces using
the 'broargs' route. I'm not seeing much of a drop in resources or uptick
in packet drops even with my node.cfg file defined to use
'lb_procs=myricom' and the second interface not being a Myricom-based NIC.
Dunno if it would cause efficiency loss but I'm not able to detect it.

On Wed, Apr 5, 2017 at 7:48 PM, Samuel Oehlert <soehlert at es.net> wrote:

> I've always done a separate worker in that case, which I believe is the
> most common way, though I'm not sure if one way is correct vs incorrect, or
> just common vs uncommon.
> -Sam
> On Wed, Apr 5, 2017 at 12:09 PM, Espresso Beanies <
> espressobeanies at gmail.com> wrote:
>> Good afternoon,
>> I'm trying to see what would be the best way to direct Bro to listen on
>> multiple interfaces. I currently have one interface defined in my node.cfg
>> file but to add the second, is it best to create a separate worker or
>> define the interface in broctl using 'broargs'?
>> Thanks,
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170406/b4053101/attachment.html 

More information about the Bro mailing list