You'll need to collect the following information before beginning the installation.
ifconfig -a
to get the list of all network interfaces on your Bro host.
If you want to use Bro's periodic email report feature, you'll also need:
Bro is easy to install. Log in as root
, and type:
./configure
By default Bro is installed in /usr/local/bro
.
This location
is referred to in the rest of the manual as $BROHOME
.
To install Bro in a location other than /usr/local/bro, use:
./configure --prefix=/path/to/bro
By default Bro uses the version of libpcap that is installed on the system. If your system version older than version 0.7.2, you can run configure Bro with –enable-shippedpcap to use the version of libpcap that comes packaged with Bro. For example:
./configure --enable-shippedpcap
Then type:
make make install
or
make install-brolite
Use make install to install all the Bro binaries and policy script files. Use
make install-brolite to also run the configuration script (described in the next section) and install all the configuration files and cron
jobs. make install can be run as any user, but make install-brolite requires
you to be root.
To update an existing Bro installation with new binaries and standard policy files, instead
of "make install"
do a "make update"
. This will preserve all your local customizations.
Then add $BROHOME/bin
and $BROHOME/scripts
to your $PATH to use
Bro's utilities and scripts.
Also note that this documentation is installed in $BROHOME/docs
as both HTML and PDF versions.