[Bro] How to configure Bro to listen on multiple interfaces

김희철 hckim at narusec.com
Thu May 10 00:56:06 PDT 2018


Hi
if you are using broctl
change node.cfg file

[bro]
type=standalone
host=localhost
interface='eth0 -i eth1 -i eth2 -i eth3'

but there is catch, you can not use 'broctl capstats'



>
> ------------------------------
>
> Message: 5
> Date: Wed, 9 May 2018 12:45:35 -0400
> From: Charles Mckee <charles.mckee at decisivedge.com>
> Subject: [Bro] How to configure Bro to listen on multiple interfaces
> To: bro at bro.org
> Message-ID: <5703cb07cdb65808928b48f87381e47f at mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hello Bro,
>
>
>
> I have been researching the net and cannot find a clear way for my
> scenario.
>
>
>
> I have bro in standalone mode, it has been running but now we added another
> nic to bro and want Bro to monitor on that nic as well keeping it in
> standalone mode.
>
>
>
> How can I make this happen, please can one how me what and where I need to
> make changes ?
>
>
>
> Respectfully Yours
>
> Charles McKee
>
>
>
> *Decisiv**E**dge**, LLC*
>
> *O:*  302.299.1570 x43 <(302)%20299-1570>2  *|*  *C:*  302.3
> <(302)%20299-0406>20.6968  *|*  *F:*  302.299.1578 <(302)%20299-1578>
>
> 131 Continental Dr |  Suite 409  |  Newark, DE 19713
> <https://maps.google.com/?q=131+Continental+Dr+%7C+%C2%
> A0Suite+409+%C2%A0%7C+%C2%A0Newark,+DE+19713&entry=gmail&source=g>
>
> charles.mckee at decisivedge.com  *|*  www.DecisivEdge.com
> <http://www.decisivedge.com/>
>
> --
> This email and any files transmitted with it are considered privileged and
> confidential unless otherwise explicitly stated otherwise. If you are not
> the intended recipient you are notified that disclosing, copying,
> distributing or taking any action in reliance on the contents of this
> information is strictly prohibited. All email data and contents may be
> monitored to ensure that their use is authorized, for management of the
> system, to facilitate protection against unauthorized use, and to verify
> security procedures, survivability and operational security. Under no
> circumstance should the user of this email have an expectation of privacy
> for this correspondence.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/
> 20180509/e60565a9/attachment.html
>
> ------------------------------
>
> _______________________________________________
> Bro mailing list
> Bro at bro.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
>


-- 
------------------------------------------------------
Hichul Kim 김희철 선임 연구원

Naru Security  (주)나루씨큐리티
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180510/ff883987/attachment.html 


More information about the Bro mailing list