This article is outdated and may not work correctly for current operating systems or software.
Bro is an open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Bro supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and help with troubleshooting.
Before installing Bro, youâll need to ensure that some dependencies are in place:
Libpcap
OpenSSL libraries
BIND8 library
Libz
Bash (for BroControl)
Python 2.6+ or greater (for BroControl)
The Sendmail
is not required, but strongly recommended.
Before installing any packages it's recommended to update the system packages. Run the command dnf --assumeyes update
. This will download and install latest versions of the system packages. Package manager will automatically answer yes to prompts offered. It can take some time.
You'll need to install required packages on your system. Run the following command:
dnf --assumeyes install libpcap openssl python zlib sendmail
Run command dnf install --assumeyes bro
This command will install bro
into /bin
directory. And now let's configure it.
Create folders: mkdir -p /var/log/bro
and mkdir -p /var/spool
Since Fedora 2x interface naming was changed, so let's find out current iface name:
ls /sys/class/net
. Output should be similar to this one: ens3 lo
, or this one: eth0 lo
. In the first case we are interested in ens3
interface name, in the second one -- eth0
. Let's assume that we have ens3
.
Now, examine file /etc/bro/node.cfg
. Run command less /etc/bro/node.cfg
. At the line 11 there is network interface specification:
interface=eth0
. If your iface name is eth0
-- let file without changes and continue to the next step. Otherwise -- change it with ens3
. For that run this command: sed -i 's/eth0/ens3'
. Option -i
stands for changing the file in-place. s
will substitute value enclosed between first and second slashes to the value between second and third one.
Add variables to the config file:
echo "LibDirInternal = /usr/lib/python2.7/site-packages/BroControl/" >> /etc/bro/broctl.cfg
echo "SpoolDir = /var/spool" >> /etc/bro/broctl.cfg
echo "LogDir = /var/log/bro" >> /etc/bro/broctl.cfg
echo "CfgDir = /etc/bro" >> /etc/bro/broctl.cfg
Now we can deploy our configured node and start logging:
Run command broctl deploy
. You'll see output like this:
cannot get list of local IP addresses
checking configurations ...
installing ...
removing old policies in /var/spool/installed-scripts-do-not-touch/site ...
removing old policies in /var/spool/installed-scripts-do-not-touch/auto ...
creating policy directories ...
installing site policies ...
generating standalone-layout.bro ...
generating local-networks.bro ...
generating broctl-config.bro ...
generating broctl-config.sh ...
updating nodes ...
stopping ...
stopping bro ...
starting ...
starting bro ...
If you didn't get any errors -- bro is deployed.
Now let's look at the logs: ls -la /var/log/bro
.
Output should be similar to this one:
total 12
drwxr-xr-x 3 root root 4096 Jun 13 10:11 .
drwxr-xr-x 1 root root 4096 Jun 13 10:04 ..
drwxr-xr-x 2 root root 4096 Jun 13 10:11 2017-06-13
lrwxrwxrwx 1 root root 14 Jun 13 10:11 current -> /var/spool/bro
Run this command to tail logs: tail -f /var/log/bro/current/conn.log
and query your ip from browser.
If everything was configured correctly, you'll see log messages.
Enjoy!