zeek January 2009

zeek@lists.zeek.org

17 participants
19 discussions

by Martin Fontanez

Never mind, looks like I need to do a make install-brolite and them look at the /etc/bro.cfg file. Thanks. --- On Thu, 1/29/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote: From: Martin Fontanez <jdmfontz(a)yahoo.com> Subject: Log Files To: Bro(a)bro-ids.org Date: Thursday, January 29, 2009, 2:57 PM Just got Bro up and running. How do I configure where log files are written to? Thanks, Martin

12 years, 2 months

[Bro] Log Files

by Martin Fontanez

Just got Bro up and running. How do I configure where log files are written to? Thanks, Martin

12 years, 2 months

Re: [Bro] Bro-1.4 Install Question

by Martin Fontanez

Hello. Thank you. It looks like I have gcc and c++ pkgs installed. [root@localhost opt]# rpm -qa | grep gcc compat-gcc-34-c++-3.4.6-4 compat-libgcc-296-2.96-138 compat-gcc-34-3.4.6-4 libgcc-4.1.2-42.el5 gcc-4.1.2-42.el5 compat-gcc-34-g77-3.4.6-4 [root@localhost opt]# It looks like I also have g++ which gets installed as part of gcc install. Does this looks like a bro bug? [root@localhost opt]# find / -name "g++*" /usr/bin/g++34 /opt/gcc-4.3.3/gcc/cp/g++spec.c [root@localhost opt]# Regards, Martin --- On Fri, 1/23/09, rmkml <rmkml(a)free.fr> wrote: From: rmkml <rmkml(a)free.fr> Subject: Re: [Bro] Bro-1.4 Install Question To: "Martin Fontanez" <jdmfontz(a)yahoo.com> Date: Friday, January 23, 2009, 8:06 AM Hi, need c++ compilator... Regards Rmkml Crusoe-Researches.com On Fri, 23 Jan 2009, Martin Fontanez wrote: > Date: Fri, 23 Jan 2009 06:35:01 -0800 (PST) > From: Martin Fontanez <jdmfontz(a)yahoo.com> > To: Bro(a)bro-ids.org, Christian Kreibich <christian(a)whoop.org> > Subject: Re: [Bro] Bro-1.4 Install Question > > I installed the ncurses-devel pkg and ./configure ran ok. Now I am getting the following errors on make: > > Making all in lib > make[6]: Entering directory `/opt/bro-1.4/aux/binpac/lib' > source='binpac_buffer.cc' object='binpac_buffer.o' libtool=no \ > DEPDIR=.deps depmode=none /bin/sh ../depcomp \ > g++ -DHAVE_CONFIG_H -I. -I. -I.. -c -o binpac_buffer.o binpac_buffer.cc > ../depcomp: line 414: exec: g++: not found > make[6]: *** [binpac_buffer.o] Error 127 > make[6]: Leaving directory `/opt/bro-1.4/aux/binpac/lib' > make[5]: *** [all-recursive] Error 1 > make[5]: Leaving directory `/opt/bro-1.4/aux/binpac' > make[4]: *** [all] Error 2 > make[4]: Leaving directory `/opt/bro-1.4/aux/binpac' > make[3]: *** [all-recursive] Error 1 > make[3]: Leaving directory `/opt/bro-1.4/aux' > make[2]: *** [all] Error 2 > make[2]: Leaving directory `/opt/bro-1.4/aux' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/opt/bro-1.4' > make: *** [all] Error 2 > [root@localhost bro-1.4]# > > Thanks, > > Martin > > --- On Thu, 1/22/09, Christian Kreibich <christian(a)whoop.org> wrote: > From: Christian Kreibich <christian(a)whoop.org> > Subject: Re: [Bro] Bro-1.4 Install Question > To: jdmfontz(a)yahoo.com > Cc: Bro(a)bro-ids.org > Date: Thursday, January 22, 2009, 3:49 PM > > On Wed, 2009-01-21 at 11:28 -0800, Martin Fontanez wrote: > > I am getting a "no terminal emulation library found" error on > > configure yet as you can see below ncurse and termcap packages are > > installed. I am using RedHat Linux EL5. Does > anyone have an idea of > > why is that? Thanks in advance. > Please install the -devel packages as well, and let us know how it > goes. -- Cheers, > Christian > > > >

12 years, 2 months

Re: [Bro] Bro-1.4 Install Question

by Martin Fontanez

Thanks everyone for all the comments and help. After removing an install of /opt/libpcap-0.9.8 since I had libpcap-0.9.4-12.el5 also installed; and re-running ./configure, make ran without errors. So did make install. Looks like my box is up and running. Thank you! Martin PS. Looks like Bro INSTALL doc file might need updating to indicate that corresponding *-devel-* packages also need to be installed. --- On Tue, 1/27/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote: From: Martin Fontanez <jdmfontz(a)yahoo.com> Subject: Re: [Bro] Bro-1.4 Install Question To: Bro(a)bro-ids.org, "rmkml" <rmkml(a)free.fr> Date: Tuesday, January 27, 2009, 1:20 PM Update. I created a link /usr/bin/g++ for /usr/bin/g++34 and went pass this error on make. Now I am getting this error on make: source='X509.cc' object='X509.o' libtool=no \ DEPDIR=.deps depmode=none /bin/sh ../depcomp \ g++ -DHAVE_CONFIG_H -I. -I. -I.. -I. -I../aux/binpac/lib -I../src -I. -I.. -Ilibedit -I/opt/libpcap-0.9.8 -I../linux-include -I/usr/local/include -O -W -Wall -Wno-unused -I/opt/libpcap-0.9.8 -I../linux-include -I/usr/local/include -c -o X509.o X509.cc X509.cc: In function `X509* d2i_X509_(X509**, const u_char**, int)': X509.cc:18: error: invalid conversion from `u_char**' to `const unsigned char**' X509.cc:18: error: initializing argument 2 of `X509* d2i_X509(X509**, const unsigned char**, long int)' make[3]: *** [X509.o] Error 1 make[3]: Leaving directory `/opt/bro-1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/opt/bro-1.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/opt/bro-1.4' make: *** [all] Error 2 [root@localhost bro-1.4]# Any help is appreciated. Thank you, Martin --- On Tue, 1/27/09, Martin Fontanez <jdmfontz(a)yahoo.com> wrote: From: Martin Fontanez <jdmfontz(a)yahoo.com> Subject: Re: [Bro] Bro-1.4 Install Question To: Bro(a)bro-ids.org, "rmkml" <rmkml(a)free.fr> Date: Tuesday, January 27, 2009, 10:56 AM Hello. Thank you. It looks like I have gcc and c++ pkgs installed. [root@localhost opt]# rpm -qa | grep gcc compat-gcc-34-c++-3.4.6-4 compat-libgcc-296-2.96-138 compat-gcc-34-3.4.6-4 libgcc-4.1.2-42.el5 gcc-4.1.2-42.el5 compat-gcc-34-g77-3.4.6-4 [root@localhost opt]# It looks like I also have g++ which gets installed as part of gcc install. Does this looks like a bro bug? [root@localhost opt]# find / -name "g++*" /usr/bin/g++34 /opt/gcc-4.3.3/gcc/cp/g++spec.c [root@localhost opt]# Regards, Martin --- On Fri, 1/23/09, rmkml <rmkml(a)free.fr> wrote: From: rmkml <rmkml(a)free.fr> Subject: Re: [Bro] Bro-1.4 Install Question To: "Martin Fontanez" <jdmfontz(a)yahoo.com> Date: Friday, January 23, 2009, 8:06 AM Hi, need c++ compilator... Regards Rmkml Crusoe-Researches.com On Fri, 23 Jan 2009, Martin Fontanez wrote: > Date: Fri, 23 Jan 2009 06:35:01 -0800 (PST) > From: Martin Fontanez <jdmfontz(a)yahoo.com> > To: Bro(a)bro-ids.org, Christian Kreibich <christian(a)whoop.org> > Subject: Re: [Bro] Bro-1.4 Install Question > > I installed the ncurses-devel pkg and ./configure ran ok. Now I am getting the following errors on make: > > Making all in lib > make[6]: Entering directory `/opt/bro-1.4/aux/binpac/lib' > source='binpac_buffer.cc' object='binpac_buffer.o' libtool=no \ > DEPDIR=.deps depmode=none /bin/sh ../depcomp \ > g++ -DHAVE_CONFIG_H -I. -I. -I.. -c -o binpac_buffer.o binpac_buffer.cc > ../depcomp: line 414: exec: g++: not found > make[6]: *** [binpac_buffer.o] Error 127 > make[6]: Leaving directory `/opt/bro-1.4/aux/binpac/lib' > make[5]: *** [all-recursive] Error 1 > make[5]: Leaving directory `/opt/bro-1.4/aux/binpac' > make[4]: *** [all] Error 2 > make[4]: Leaving directory `/opt/bro-1.4/aux/binpac' > make[3]: *** [all-recursive] Error 1 > make[3]: Leaving directory `/opt/bro-1.4/aux' > make[2]: *** [all] Error 2 > make[2]: Leaving directory `/opt/bro-1.4/aux' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/opt/bro-1.4' > make: *** [all] Error 2 > [root@localhost bro-1.4]# > > Thanks, > > Martin > > --- On Thu, 1/22/09, Christian Kreibich <christian(a)whoop.org> wrote: > From: Christian Kreibich <christian(a)whoop.org> > Subject: Re: [Bro] Bro-1.4 Install Question > To: jdmfontz(a)yahoo.com > Cc: Bro(a)bro-ids.org > Date: Thursday, January 22, 2009, 3:49 PM > > On Wed, 2009-01-21 at 11:28 -0800, Martin Fontanez wrote: > > I am getting a "no terminal emulation library found" error on > > configure yet as you can see below ncurse and termcap packages are > > installed. I am using RedHat Linux EL5. Does > anyone have an idea of > > why is that? Thanks in advance. > Please install the -devel packages as well, and let us know how it > goes. -- Cheers, > Christian > > > > _______________________________________________ Bro mailing list bro(a)bro-ids.org http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

12 years, 2 months

[Bro] Question re: Filtering an IP Range

by nlange＠ucalgary.ca

We are very new to the Bro environment, and are learning as we go. We have managed to install Bro and get the Brolite environment working. We would like to filter a range of IP addresses, and haven't quite been able to figure out how to do this. Any help would be greatly appreciated. Thanks. Norbert

12 years, 2 months

[Bro] Bro-1.4 Install Question

by Martin Fontanez

I am getting a "no terminal emulation library found" error on configure yet as you can see below ncurse and termcap packages are installed. I am using RedHat Linux EL5. Does anyone have an idea of why is that? Thanks in advance. configure: error: No terminal emulation library found! Consider installing termcap, curses, or ncurses. [root@localhost bro-1.4]# rpm -qa | grep ncurse* ncurses-5.5-24.20060715 [root@localhost bro-1.4]# rpm -qa | grep termcap termcap-5.5-1.20060701.1 libtermcap-2.0.8-46.1 [root@localhost bro-1.4]# rpm -qa | grep curses ncurses-5.5-24.20060715 [root@localhost bro-1.4]#

12 years, 2 months

[Bro] Running Multiple Copies of Bro

by nlange＠ucalgary.ca

Hello, and thanks to everyone (especially Robin) who responded to my questions about geting Bro configured on an Ubuntu system. Now that we have Bro running, we would like to be able to run more than one copy to take advantage of a multi-core machine. We are working on the theory that assigning separate copies of Bro to different processors may improve performance if we separate some of the tasks that each copy needs to perform. We tried simply copying the bro.rc file and calling it bro2.rc, but this doesn't work. We're a bit new at this, so any help would be appreciated. Regards, Norbert

12 years, 2 months

[Bro] Brolite/Ubuntu Installation "No such file or directory" error

by nlange＠ucalgary.ca

Hello, I apologize if this message shows up twice. I tried sending it to one address indicated in some documentation, and then another address provided as part of my confirmation to joining this list. We are a group of students working on our fourth year project at the University of Calgary. As part of our project, we need to install Bro on an Ubuntu system. We are working with the current version of Ubuntu and Bro. The error message looks as follows: make[1]: Leaving directory '/home/terminator/bro-1.4/aux' /bin/chown -R 'cat scripts/bro_user_id' /usr/local/bro/ cat: scripts/bro_user_id: No such file or directory /bin/chown: missing operand after '/usr/local/bro/' Try '/bin/chown --help' for more information make: [install-brolite] Error 1 (ignored) ********************************************************* Please run "/usr/local/bro/etc/bro.rc --start" to start bro ********************************************************* The file /usr/local/bro/etc/bro.rc also does not exist. Any help you could offer would be very much appreciated. Norbert Lange

12 years, 2 months

Re: [Bro] BroLite install (was: Bro 1.4 release now available)

by Peter Hart-Davis - MWEB

Hi there I am new to Bro and the list so Greetings. Some feedback as requested. I am installing on Slackware 10.2.0 (old I know) gcc version 3.3.6, which was pretty straight forward although I have snort/libpcap etc installed from source and a PF Ring kernel so it is far from a vanilla Slackware. I had done a 'manual' install of Bro 1.4 prior to patching Bro for a BroLite install, I deleted and re-installed as I felt that I had missed a few things which did turn out to be the case e.g the perl reporting scripts. On patching and running "make install-brolite" all seems good 'out of the box' except I had to add "/usr/local/bro/site" to BROPATH in etc/bro.cfg, from my reading I gather this is likely due to a new location of site to share/bro/site? A suggestion, possibly a simple 'what goes where' or 'what is to be expected where' in the docs? Peter Peter Hart-Davis Senior Technical Engineer: MWEB IT Security Team Multichoice Subscriber Management services: Internet Division Tel.: + 27 021 596 8103 Cell: + 27 083 414 7455 Fax: + 27 021 596 8381 E-mail: phartdavis(a)mweb.com Registered Linux User #28564 Registered CISSP #89701 MSN: trip_tango(a)hotmail.com New from MWEB: Cellphone and Internet bundles! Bundle your Internet access with your cellular contract from R75 per month. Call 08600 32000 or click here(http://www.mweb.co.za/productsservices/MTALKMobile/tabid/1223/Default.aspx) for more info on the great deals available. MWEB :-) JUST LIKE THAT This electronic communication and the attached file(s) are subject to a disclaimer which can be accessed on the following link: Disclaimer - or copy the following URL into your browser - http://www.mweb.co.za/disclaimer. If you are unable to view the disclaimer, please contact abuse(a)mweb.com for a copy.

12 years, 2 months

[Bro] Brolite/Ubuntu Installation "No such file or directory" error

by nlange＠ucalgary.ca

Hello, We are a group of students working on our fourth year project at the University of Calgary. As part of our project, we need to install Bro on an Ubuntu system. We are working with the current version of Ubuntu and Bro. The error message looks as follows: make[1]: Leaving directory '/home/terminator/bro-1.4/aux' /bin/chown -R 'cat scripts/bro_user_id' /usr/local/bro/ cat: scripts/bro_user_id: No such file or directory /bin/chown: missing operand after '/usr/local/bro/' Try '/bin/chown --help' for more information make: [install-brolite] Error 1 (ignored) ********************************************************* Please run "/usr/local/bro/etc/bro.rc --start" to start bro ********************************************************* The file /usr/local/bro/etc/bro.rc also does not exist. Any help you could offer would be very much appreciated. Norbert Lange

12 years, 2 months

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

zeek January 2009