[Oisf-users] options for multiple interfaces

Chris Edwards Chris.Edwards at glasgow.ac.uk
Thu Oct 31 20:52:53 UTC 2013

On Thu, 31 Oct 2013, Kevin Branch wrote:

> As to whether you can point a single instance of suricata at multiple 
> interfaces in this way

Yep, you absolutely can - no need to faff around with bonding interfaces. 
Our cmdline args are:

  suricata --pidfile -c suricata.yaml --af-packet=eth1 --af-packet=eth2 -D

and it captures from both interfaces just fine :-)

More information about the Oisf-users mailing list