Not logged in
  • Download and install Fossil SCM
Once it's installed, open the NSM file into a new local directory:
fossil open ../fossil_files/filename.fossil
  • Compile customized bro
A customized version of Bro 1.5.1 is used. The primary difference is the addition of an entropy function. Only works to get 1g entropy at this point though.
  • Ensure that run_bro.sh is changed to reflect your environment.
Comments in the script should tell you what to change. I've found that because of the processing bro is doing, it will easily kill 8GB of RAM when processing 10-15GB PCAP files if it's only running two concurrent processes.
  • Execute run_bro.sh
Wait... output status if given via 'pv', however if multiple processes are running and outputting the screen, they will routinely overwrite each other
  • Load mysql schema
user@linux$ mysql -u USERNAME DATABASE_NAME < dv-tables.sql
  • Edit loading script to point at proper output location
  • Run MySQL loading script
user@linux$ mysql -u USERNAME -p DATABASE_NAME < load-dv.sql
  • Find bad stuff
Everything else is pretty much left to you to run SQL queries on the data