D 2010-12-08T16:12:19 L dvessey-bro-analysis-howto P aa64d573b34679bbfc7d4dd956078937e41dee97 U david W 1604
* Download and install Fossil SCM | Once it's installed, open the NSM file into a new local directory:
|
* Compile customized bro | A customized version of Bro 1.5.1 is used. The primary difference is the addition of an entropy function. Only works to get 1g entropy at this point though. |
* Ensure that run_bro.sh is changed to reflect your environment. | Comments in the script should tell you what to change. I've found that because of the processing bro is doing, it will easily kill 8GB of RAM when processing 10-15GB PCAP files if it's only running two concurrent processes. |
* Execute run_bro.sh | Wait... output status if given via 'pv', however if multiple processes are running and outputting the screen, they will routinely overwrite each other |
* Load mysql schema |
|
* Edit loading script to point at proper output location | |
* Run MySQL loading script |
|
* Find bad stuff | Everything else is pretty much left to you to run SQL queries on the data |