Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
Artifact ID: | 65a86c7b18b9e6ce6e6ae426a29ddf701bbea589 |
---|---|
Page Name: | dvessey-bro-analysis-howto |
Date: | 2010-12-08 16:12:19 |
Original User: | david |
Parent: | aa64d573b34679bbfc7d4dd956078937e41dee97 (diff) |
Content
|
Once it's installed, open the NSM file into a new local directory:
fossil open ../fossil_files/filename.fossil |
|
A customized version of Bro 1.5.1 is used. The primary difference is the addition of an entropy function. Only works to get 1g entropy at this point though. |
|
Comments in the script should tell you what to change. I've found that because of the processing bro is doing, it will easily kill 8GB of RAM when processing 10-15GB PCAP files if it's only running two concurrent processes. |
|
Wait... output status if given via 'pv', however if multiple processes are running and outputting the screen, they will routinely overwrite each other |
|
user@linux$ mysql -u USERNAME DATABASE_NAME < dv-tables.sql |
|
|
|
user@linux$ mysql -u USERNAME -p DATABASE_NAME < load-dv.sql |
|
Everything else is pretty much left to you to run SQL queries on the data |