diff --git a/core/engine.py b/core/engine.py
index 53c55d6..c725981 100644
--- a/core/engine.py
+++ b/core/engine.py
@@ -225,6 +225,7 @@ class Engine:
             if actual_iface:
                 self.config.setdefault("network", {})["primary_interface"] = actual_iface
                 logger.debug("Resolved auto interface to: %s", actual_iface)
+        self.capture_bus = None
         self._lock = multiprocessing.Lock()
         logger.info("Engine initialized (tier=%s, phase=%s)", self._tier, self._phase)
 
@@ -342,6 +343,24 @@ class Engine:
     def start_all(self) -> dict[str, bool]:
         """Start all registered modules in dependency order."""
         order = _topo_sort(self._modules)
+        
+        # Instantiate and start CaptureBus for passive modules
+        iface = self.config.get("network", {}).get("primary_interface")
+        if iface:
+            try:
+                from core.capture_bus import CaptureBus
+                self.capture_bus = CaptureBus(interface=iface)
+                self.capture_bus.start()
+                logger.info("CaptureBus started on %s", iface)
+            except Exception as e:
+                logger.error("Failed to start CaptureBus: %s", e)
+                self.capture_bus = None
+        
+        # Inject capture_bus into module configs for passive modules
+        for name, entry in self._modules.items():
+            if getattr(entry.module_class, "requires_capture_bus", False):
+                entry.config["capture_bus"] = self.capture_bus
+        
         results = {}
         for name in order:
             results[name] = self.start(name)
@@ -352,6 +371,14 @@ class Engine:
         order = _topo_sort(self._modules)
         for name in reversed(order):
             self.stop(name, timeout=timeout)
+        
+        # Stop CaptureBus after all modules
+        if self.capture_bus:
+            try:
+                self.capture_bus.stop()
+                self.capture_bus = None
+            except Exception as e:
+                logger.error("Failed to stop CaptureBus: %s", e)
 
     def get_status(self, name: str = None) -> dict:
         """Get status of one module or all modules."""