[Zeek] Interface Removed From Config but Keeps Monitoring Traffic

[Kevin Ross]

Hi,

I configured an afpacket interface in addition to one I was already using
and it monitored fine but I want to stop monitoring this link for now and
just leave it to Suricata at the moment.

I have removed the configuration for it and redeployed, cleaned and
everything else I can thing of and many config installs and when started
while only the works configured on the original interface show in running
jobs I am still getting traffic events from the other interface (I know
this because of the IPs being monitored).

Is there anything I can check or clean up to try and force bro to
completely "forget" it ever knew about this interface? Thanks.


Kind Regards,
Kevin Ross
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190410/5cca1abe/attachment.html