Next: , Previous: Running Bro on network traffic, Up: Running Bro on network traffic



2.1.4.1 Live traffic

Bro reads live traffic from the local network interface whenever you specify the -i flag. As mentioned below, you can specify multiple instances to read from multiple interfaces simultaneously, however the interfaces must all be of the same link type (e.g., you can't mix reading from a Fast Ethernet with reading from an FDDI link, though you can mix a 10 Mbps Ethernet interface with a 100 Mbps Ethernet).

In addition, Bro will read live traffic from the interface(s) listed in the interfaces variable, unless you specify the -r flag (and do not specify -i). So, for example, if your policy script contains:

         const interfaces += "sk0";
         const interfaces += "sk1";

then Bro will read from the sk0 and sk1 interfaces, and you don't need to specify -i.