[Bro] Question about listening on multiple interfaces

[Espresso Beanies]

I see. Yep. I confirmed I'm able to see traffic on both interfaces using
the 'broargs' route. I'm not seeing much of a drop in resources or uptick
in packet drops even with my node.cfg file defined to use
'lb_procs=myricom' and the second interface not being a Myricom-based NIC.
Dunno if it would cause efficiency loss but I'm not able to detect it.

On Wed, Apr 5, 2017 at 7:48 PM, Samuel Oehlert <soehlert at es.net> wrote:

> I've always done a separate worker in that case, which I believe is the
> most common way, though I'm not sure if one way is correct vs incorrect, or
> just common vs uncommon.
>
> -Sam
>
> On Wed, Apr 5, 2017 at 12:09 PM, Espresso Beanies <
> espressobeanies at gmail.com> wrote:
>
>> Good afternoon,
>>
>> I'm trying to see what would be the best way to direct Bro to listen on
>> multiple interfaces. I currently have one interface defined in my node.cfg
>> file but to add the second, is it best to create a separate worker or
>> define the interface in broctl using 'broargs'?
>>
>> Thanks,
>>
>>
>>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170406/b4053101/attachment.html