[Zeek] First attempt to upgrade to 3: Multiple interfaces

James Lay jlay at slave-tothe-box.net
Tue Mar 3 11:03:16 PST 2020


Welp...out of luck so far:

/opt/zeek/bin/zeek -C -i eth0 -i eth1 --filter '<redacted>' local 
"Site::local_nets += { 192.168.1.0/24 }"

gets me:

ERROR: Only a single interface option (-i) is allowed.

I didn't have this issue with 2.  Any reason why only one interface is 
allowed now?  Unless something radical has changed with the resources 
that zeekctl uses I have no desire to use it.  I'm dead in the water 
with Zeek as of now.  Thank you.

James


More information about the Zeek mailing list