Next: , Up: Running Bro



4.1 Starting Bro

Bro is automatically started at boot time via the bro.rc script, ( located in /usr/local/bro/etc and /usr/local/etc/rc.d on FreeBSD or /usr/init.d on Linux )

To run this script by hand, type:

     bro.rc start

or

     bro.rc checkpoint

or

     bro.rc stop

Use checkpoint to restart Bro, loading a new policy file.

To get feel for what Bro logs will look like on your traffic, do the following:

Generate some "offline" data to play with:

      # tcpdump -s 0 -w trace.out

Kill off the tcpdump after capturing traffic for a few minutes (use ctrl-C), then to run Bro against this captured trace file:

      # setenv BROHOME /usr/local/bro
      # setenv BROPATH $BROHOME/site:$BROHOME/policy
      # bro -r trace.out hostname.bro