[Bro] Multiple interfaces

[Cuttler, Matt]

> Greetings.
> 
> Can bro (running as a single process) read packets (monitor traffic)
from multiple interfaces (say > eth0 and eth1) ?


That's more of an OS thing than a Bro thing. Assuming linux, you could
use the 'bonding' module ( http://www.linuxfoundation.org/en/Net:Bonding
).

You would then tell bro to use this device as your capture interface.

It's not uncommon to need more than one interface to collect (i.e. a
regen fibre tap).

-Matt Cuttler