Support for capturing on multiple interfaces. about stenographer HOT 3 OPEN

Any update or options on this?

Can we bond interfaces or does the interface Stenographer use need to be physical?

from stenographer.

@gconnell I made some progress on this by a hack-ish work around, but it works pretty well. See my Gist below. Essentially, I created an instance template for systemd, that will start stenographer with a config located at /etc/stenographer/config.${interface}. This allows me to start an arbitrary number of instances, each with a different configuration. Each configuration has distinct directories for packets and index, as well as a distinct port.

Additionally, I had to patch stenoread to handle this, which merely loads all configurations by wildcard globbing and looping through each interface in sequence. Ideally, this would happen in parallel, but with the current implementation would require something like GNU parallel, which gets a bit tricky.

As a final note, I intend to make this the default configuration in an upcoming release of ROCK NSM (http://rocknsm.io) so that we can support multiple interfaces from each of our collection applications. In the end, this is transparent to the user and only slightly more complicated on the configuration side.

Gist: https://gist.github.com/dcode/9051a4aa7338b6c946d0a2de189912ec

from stenographer.

Can we bond interfaces or does the interface Stenographer use need to be physical?

I'm curious about this as well. Would a bonded capture interface be supported? I have a sensor with two TAP inputs and would like to capture both, so the ability to read packets from two interface would be really useful. A workaround with bonding could also help, if supported.

from stenographer.