Main Page

From BroWiki

Welcome to the Bro Wiki

This Wiki is intended for users and developers of the Bro NIDS. For users, it provides some additional documentation. For developers, it collects information which might be useful to understand the internals of Bro.

Please note that, unfortunately, we do not have the resources available to keep Bro's documentation up-to-date. For the same reason, we cannot provide comprehensive coverage in this Wiki. However we will try to continously update content here to give users and developers some idea on what's going on. Feel free to use our public mailing-list if you have further questions.

This Wiki is world-readable, but only registered users can edit pages. To get write access, send mail to bro-wiki@george.lbl.gov requesting a Wiki account.

Releases Version 1.3 (Development release) Version 1.2 (Stable release) Version 1.1 (Unsupported release) Known Issues

Related Projects Broccoli - The Bro Client Communications Library pyBroccoli - Python bindings for Broccoli Time Machine - High-Performance Packet Recording BinPAC - Generating Protocol Parsers from High Level Abstraction Bro Cluster - Operating a high-performance cluster of Bro systems.

User Contributions Emacs Bro Mode Vim Bro Mode Sample Bro Policy

User Documentation Introduction to Bro Introductory Slides & Hands-On Usage Exercises (Workshop Material) User Manual Reference Manual Connection Timers Dynamic Protocol Detection - Bro's dynamic analyzer framework (new in 1.2) Synchronizing Policy Scripts - Avoiding pitfalls in policy script synchronization GeoLocation - Finding the geographic location of ip addresses from policy scripts Analyzers FTP scan XML Bro Building Hints Host Tuning Hints "Error compiling pattern" - no signatures can be compiled

Developer Documentation Built-in Functions (BiFs) Build Configuration on FreeBSD Creating Patches - Creating Patches for the Bro Source Tree API for Dynamic Protocol Detection - How to program with Bro's dynamic analyzer framework (new in 1.2) IPv6 - Coding Bro internals for compatibility with IPv6 Regression Testing - Regression testing procedure Subversion - Using the Subversion repository State Serialization - How to make classes serializable HOWTOs - cookbook recipes for things that come up regularly Obsolete information (kept for reference only) Flow Reassembly Database Use Cases