[Bro] Network tap issues

[Hovsep Levi]

I've dealt with this before although I don't really understand it
technically.  Some sort of layer1-ish protocol.. the only way I can explain
it is something like Cisco's UDLD.. the NIC detects a fault in the circuit
due to a half connected state and shuts down the laser/LED for safety
reasons.

You might find some obscure low-level setting for the NIC to force it into
a special monitor mode similar to how wifi monitor mode works.

What happens if you force the interface up and run tcpdump ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170621/2df51d64/attachment.html