Exercise

Run bro with the -r option, and provide the http.pcap file. For more information on bro options, please run bro with the -h option.

Exercise

For this, you’ll need misc.pcap.

Run this command:

bro -r misc.pcap

and then interpret the fields in each of the resulting logs. Examine relevant records in the associated script files; be sure to look for the &log directive when examining those files.

Exercise

List the connections by in increasing order of duration, i.e., the longest connections at the end.

Exercise

Find all connections that last longer than one minute.

Exercise

Find all IP addresses of web servers that send more than more than 1 KB back to a client.

Exercise

Are there any web servers on non-standard ports (i.e., 80 and 8080)?

Exercise

Show a breakdown of the number of connections by service.

Exercise

Show the top 10 destination ports in descending order.

Exercise

What are the top 10 hosts (originators) that send the most traffic?

Exercise

What are the distinct browsers in this trace? What are the distinct MIME types of the downloaded URLS?

Exercise

What are the three most commonly accessed web sites?

Exercise

What are the top 10 referred hosts?

Exercise

Tell Bro to include the new_separator.bro script, and then re-process http.pcap. After verifying that the separator character has, in fact, changed, modify the separator character defined in new_separator.bro to be something slightly more interesting. Next, re-run Bro and verify that the separator character worked as expected and that the #separator field at the top of the file was updated appropriately. Now, add a line to new_separator.bro that will change the comment character used in the log file; consult base/frameworks/logging/writers/ascii.bro to determine the appropriate incantation.