You'll need to collect the following information before beginning the installation.
ifconfig -a
to get the list of all network interfaces on your Bro host.
If you want to use Bro's periodic email report feature, you'll also need:
Bro is easy to install. Log in as root
, and type:
./configureBy default Bro is installed in
/usr/local/bro
.
This location
is referred to in the rest of the manual as $BROHOME
.
To install Bro in a location other than /usr/local/bro
, use:
./configure --prefix=/path/to/broBy default Bro uses the version of libpcap that is packaged with the Bro source code. To use the system default version of libpcap, use:
./configure --disable-localpcap
Then type:
make make installor
make install-brolite
Use make install to install all the Bro binaries and policy script files. Use
make install-brolite to also run the configuration script (described in the next section) and install all the configuration files and cron
jobs. make install can be run as any user, but make install-brolite requires
you to be root.
To update an existing Bro installation with new binaries and standard policy files, instead
of "make install"
do a "make update"
. This will preserve all your local customizations.
Then add $BROHOME/bin
and $BROHOME/scripts
to your $PATH to use
Bro's utilities and scripts.
Also note that this documentation is installed in $BROHOME/docs
as both HTML and PDF versions.