Bro reads live traffic from the local network interface whenever you
specify the -i
flag. As mentioned below, you can specify
multiple instances to read from multiple interfaces simultaneously,
however the interfaces must all be of the same link type (e.g., you
can't mix reading from a Fast Ethernet with reading from an FDDI link,
though you can mix a 10 Mbps Ethernet interface with a 100 Mbps Ethernet).
In addition, Bro will read live traffic from the interface(s) listed in
the interfaces
variable, unless you specify
the -r
flag (and do not specify -i
). So, for
example, if your policy script contains:
const interfaces += "sk0"; const interfaces += "sk1";
then Bro will read from the sk0 and sk1 interfaces,
and you don't need to specify -i
.