[Bro] Bro and Darpa dataset problems

Georgios Spathoulas gspathoulas at gmail.com
Wed Jun 4 09:24:29 PDT 2008


Hello to all,

I am trying to run Bro on the 1999 Darpa dataset in order to get results 
and use them in my Phd research. I am using Bro 1.2.1 on an Ubuntu 7.10 
machine.

I have installed Bro and try to run it through the command :

/usr/local/bro/bin/bro -r outside.tcpdump brolite

where outside.tcpdump is the file containing the Darpa dataset.

If I use the default Bro 1.2.1 source code i get the known errors (error 
compiling pattern) at runtime and I get the following results :

For 5 days of data (2nd week of Darpa) I get 26318 alerts, which are 
mainly *HTTP_SensitiveURI* and a small percentage 2-3% are *sensitiveLogin.*

If I use the  Bro 1.2.1 source code after I have removed the 6 files 
from source code :

http://www.bro-ids.org/wiki/index.php/%22Error_compiling_pattern%22

I do not get any errors but I get the following results :

For 5 days of data (2nd week of Darpa) I get only 16 alerts, which are :

t=920936697.501194 no=SensitiveConnection na=NOTICE_ALARM_ALWAYS 
sa=172.16.112.194 sp=2285/tcp da=135.8.60.182 dp=23/tcp msg=hot:\ 
172.16.112.194\ 3741b\ >\ 135.8.60.182/telnet\ 30476b\ 10097.6s\ 
"lucyj"\ \ @1 tag=@1
t=921119665.164879 no=SensitiveLogin na=NOTICE_ALARM_ALWAYS 
sa=172.16.113.204 sp=8259/tcp da=195.115.218.108 dp=23/tcp user=roderica 
msg=172.16.113.204/8259\ >\ 195.115.218.108/telnet\ output\ 
"^L\\x1b[24;1H"bt.c"\ 6\ lines,\ 76\ characters\\x1b[4;9Hi\ =\ (float\ 
*)\ malloc\ (300);\\x1b[5;9Hprintf("Jumping\ to\ address:\ ha\ ha\ 
ha\\n");\\x1b[7;1H~" tag=@10
t=921120857.604970 no=SensitiveConnection na=NOTICE_ALARM_ALWAYS 
sa=172.16.113.204 sp=8259/tcp da=195.115.218.108 dp=23/tcp msg=hot:\ 
172.16.113.204\ 5330b\ >\ 195.115.218.108/telnet\ 32971b\ 18149.6s\ 
"roderica"\ \ @10 tag=@10
t=921149967.471687 no=ScanSummary na=NOTICE_ALARM_ALWAYS 
sa=204.97.153.43 num=0 msg=204.97.153.43\ scanned\ a\ total\ of\ 0\ hosts
t=921191119.811940 no=SensitiveConnection na=NOTICE_ALARM_ALWAYS 
sa=172.16.113.84 sp=5061/tcp da=195.73.151.50 dp=23/tcp msg=hot:\ 
172.16.113.84\ 2777b\ >\ 195.73.151.50/telnet\ 24910b\ 9230.2s\ 
fail/reynaldv\ "reynaldv"\ \ @10 tag=@10
t=921197787.382379 no=FTP_Sensitive na=NOTICE_ALARM_ALWAYS 
sa=194.7.248.153 sp=1112/tcp da=172.16.112.50 dp=21/tcp user=anonymous 
num=250 msg=ftp:\ 194.7.248.153/1112\ >\ 172.16.112.50/ftp\ #93\ RNTO\ 
.rhosts\ (ok)
t=921236083.657840 no=ScanSummary na=NOTICE_ALARM_ALWAYS 
sa=207.103.80.104 num=0 msg=207.103.80.104\ scanned\ a\ total\ of\ 0\ hosts
t=921236083.657840 no=ScanSummary na=NOTICE_ALARM_ALWAYS 
sa=209.117.157.183 num=0 msg=209.117.157.183\ scanned\ a\ total\ of\ 0\ 
hosts
t=921236083.657840 no=SensitiveConnection na=NOTICE_ALARM_ALWAYS 
sa=172.16.114.168 sp=22889/tcp da=197.182.91.233 dp=23/tcp msg=hot:\ 
172.16.114.168\ 6003b\ }3\ 197.182.91.233/telnet\ 57126b\ 14024.9s\ 
"kiaraa"\ \ @8 tag=@8
t=921276791.470544 no=AddressDropped na=NOTICE_ALARM_ALWAYS 
sa=209.167.99.71 sp=1029/tcp da=172.16.112.50 dp=5/tcp msg=low\ port\ 
trolling\ 209.167.99.71\ 5/tcp tag=@8
t=921276801.859385 no=PortScan na=NOTICE_ALARM_ALWAYS sa=209.167.99.71 
sp=2106/tcp da=172.16.112.50 dp=78/tcp msg=209.167.99.71\ has\ scanned\ 
50\ ports\ of\ 172.16.112.50 tag=@9
t=921276831.072201 no=PortScan na=NOTICE_ALARM_ALWAYS sa=209.167.99.71 
sp=4219/tcp da=172.16.112.50 dp=284/tcp msg=209.167.99.71\ has\ scanned\ 
250\ ports\ of\ 172.16.112.50 tag=@10
t=921276938.172329 no=PortScan na=NOTICE_ALARM_ALWAYS sa=209.167.99.71 
sp=12443/tcp da=172.16.112.50 dp=1042/tcp msg=209.167.99.71\ has\ 
scanned\ 1000\ ports\ of\ 172.16.112.50 tag=@11
t=921322768.174245 no=ScanSummary na=NOTICE_ALARM_ALWAYS 
sa=204.97.153.43 num=0 msg=204.97.153.43\ scanned\ a\ total\ of\ 0\ hosts
t=921322768.174245 no=ScanSummary na=NOTICE_ALARM_ALWAYS 
sa=209.167.99.71 num=0 msg=209.167.99.71\ scanned\ a\ total\ of\ 0\ hosts
t=921322768.174245 no=SensitiveConnection na=NOTICE_ALARM_ALWAYS 
sa=172.16.114.207 sp=10102/tcp da=196.37.75.158 dp=23/tcp msg=hot:\ 
172.16.114.207\ 4060b\ }3\ 196.37.75.158/telnet\ 25337b\ 12792.4s\ 
"selmam"\ \ @6 tag=@6


I guess I am missing something. For the same data Snort produces 15000 
alerts....

If somebody has a clue what's going wrong or has successfully run Bro on 
Darpa dataset please help me

Giorgos




More information about the Bro mailing list