[Bro] Bond

[Panaman]

I bond my interfaces together and have bro listen on the bond

On Friday, September 27, 2013, wrote:

> Send Bro mailing list submissions to
>         bro at bro.org <javascript:;>
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> or, via email, send a message with subject or body 'help' to
>         bro-request at bro.org <javascript:;>
>
> You can reach the person managing the list at
>         bro-owner at bro.org <javascript:;>
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Bro digest..."
>
>
> Today's Topics:
>
>    1. Re: [EXTERNAL] Re:  Multiple interfaces on 2.2-beta-4
>       (Thomas, Eric D)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 27 Sep 2013 13:55:21 +0000
> From: "Thomas, Eric D" <edthoma at sandia.gov <javascript:;>>
> Subject: Re: [Bro] [EXTERNAL] Re:  Multiple interfaces on 2.2-beta-4
> To: Justin Azoff <JAzoff at albany.edu <javascript:;>>
> Cc: "bro at bro.org <javascript:;>" <bro at bro.org <javascript:;>>
> Message-ID: <CE6ADC36.21B23%edthoma at sandia.gov <javascript:;>>
> Content-Type: text/plain; charset="us-ascii"
>
> Thanks all for the replies. I'll try them all, starting with the easiest.
> For the record, the interfaces are both half streams, so I don't think the
> cluster method will work.
>
> --
> Eric Thomas
>
> edthoma at sandia.gov <javascript:;>
>
>
>
>
> On 9/26/13 7:37 PM, "Justin Azoff" <JAzoff at albany.edu <javascript:;>>
> wrote:
>
> >On Thu, Sep 26, 2013 at 10:27:29PM -0400, Seth Hall wrote:
> >> I guess I don't really know what to say, sniffing multiple interfaces
> >>was never something we actually supported when you run Bro with broctl
> >>and we continue not to support it.  Generally we recommend merging
> >>multiple streams of traffic upstream of where Bro receives the packets.
> >
> >What about with something like:
> >
> >[worker-1]
> >type=worker
> >host=localhost
> >interface=eth0
> >
> >[worker-2]
> >type=worker
> >host=localhost
> >interface=eth1
> >
> >as long as those aren't half streams from a tap, that should work,
> >right?
> >
> >--
> >-- Justin Azoff
> >-- Network Security & Performance Analyst
>
>
>
>
> ------------------------------
>
> _______________________________________________
> Bro mailing list
> Bro at bro.org <javascript:;>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
> End of Bro Digest, Vol 89, Issue 34
> ***********************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130928/af482b10/attachment.html