[Bro] How to configure Bro to listen on multiple interfaces

[Patrick Kelley]

Assuming you're using broctl,
add: broargs = -i eth2 
 to your broctl.cfg file

Patrick Kelley, CISSP, C|EH, ITIL
Principal Security Engineer
patrick.kelley at criticalpathsecurity.com


> On May 9, 2018, at 12:45 PM, Charles Mckee <charles.mckee at decisivedge.com> wrote:
> 
> Hello Bro,
>  
> I have been researching the net and cannot find a clear way for my scenario.
>  
> I have bro in standalone mode, it has been running but now we added another nic to bro and want Bro to monitor on that nic as well keeping it in standalone mode.
>  
> How can I make this happen, please can one how me what and where I need to make changes ?
>  
> Respectfully Yours
> 
> Charles McKee
>  
> DecisivEdge, LLC
> O:  302.299.1570 x432  |  C:  302.320.6968  |  F:  302.299.1578
> 131 Continental Dr |  Suite 409  |  Newark, DE 19713
> charles.mckee at decisivedge.com  |  www.DecisivEdge.com
>  
> 
> This email and any files transmitted with it are considered privileged and confidential unless otherwise explicitly stated otherwise. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. All email data and contents may be monitored to ensure that their use is authorized, for management of the system, to facilitate protection against unauthorized use, and to verify security procedures, survivability and operational security. Under no circumstance should the user of this email have an expectation of privacy for this correspondence.
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180509/64330d94/attachment.html