[Oisf-users] options for multiple interfaces

[Chris Edwards]

On Thu, 31 Oct 2013, Kevin Branch wrote:

> As to whether you can point a single instance of suricata at multiple 
> interfaces in this way

Yep, you absolutely can - no need to faff around with bonding interfaces. 
Our cmdline args are:

  suricata --pidfile -c suricata.yaml --af-packet=eth1 --af-packet=eth2 -D

and it captures from both interfaces just fine :-)