Next: Bro Scripts, Up: Running Bro
Bro is automatically started at boot time via the bro.rc script, ( located in /usr/local/bro/etc and /usr/local/etc/rc.d on FreeBSD or /usr/init.d on Linux )
To run this script by hand, type:
bro.rc start
or
bro.rc checkpoint
or
bro.rc stop
Use checkpoint
to restart Bro, loading a new policy file.
To get feel for what Bro logs will look like on your traffic, do the following:
Generate some "offline" data to play with:
# tcpdump -s 0 -w trace.out
Kill off the tcpdump after capturing traffic for a few minutes (use ctrl-C), then to run Bro against this captured trace file:
# setenv BROHOME /usr/local/bro # setenv BROPATH $BROHOME/site:$BROHOME/policy # bro -r trace.out hostname.bro