<table border="1">

<tr>
 <td>
  *  Download and install Fossil SCM</td>
 <td>Once it's installed, open the NSM file into a new local directory:
<verbatim>
fossil open
</verbatim>
</td>
</tr>

<tr>
 <td>
  *  Compile customized bro</td>
 <td>A customized version of Bro 1.5.1 is used. The primary difference is the addition of an entropy function. Only works to get 1g entropy at this point though.</td>
</tr>

<tr>
 <td>
  *  Ensure that run_bro.sh is changed to reflect your environment.
 </td>
 <td>
Comments in the script should tell you what to change. I've found that because of the processing bro is doing, it will easily kill 8GB of RAM when processing 10-15GB PCAP files if it's only running two concurrent processes.
 </td>
</tr>

<tr>
 <td>
  *  Execute run_bro.sh
 </td>
 <td>
Wait... output status if given via 'pv', however if multiple processes are running and outputting the screen, they will routinely overwrite each other
 </td>
</tr>

<tr>
 <td>
  *  Load mysql schema
 </td>
 <td>
<verbatim>
mysql -u USERNAME DATABASE_NAME < dv-tables.sql
</verbatim>
 </td>
</tr>

<tr>
 <td>
  *  Edit loading script to point at proper output location
 </td>
 <td>
 </td>
</tr>

<tr>
 <td>
  *  Run MySQL loading script
 </td>
 <td>
<verbatim>
mysql -u USERNAME -p DATABASE_NAME < load-dv.sql
</verbatim>
 </td>
</tr>

<tr>
 <td>
  *  Find bad stuff
 </td>
 <td>
Everything else is pretty much left to you to run SQL queries on the data
 </td>
</tr>


</table>