Bro is automatically started at boot time via the bro.rc
script (located in $BROHOME/etc
and /usr/local/etc/rc.d
on
FreeBSD, or /etc/init.d
on Linux).
To run this script by hand, type:
bro.rc startor
bro.rc checkpointor
bro.rc stop
Use checkpoint
to restart a running Bro, loading a new policy file.
Note that under Linux, Bro must be run as the 'root' user. Linux must have root privilages to capture packets.