> where I can get source code of the bro ?
The latest public snapshot is
ftp://ftp.ee.lbl.gov/.vp-bro-pub-0.7a90.tar.gz
I hope to get a significantly enhanced version out the door mid-Summer.
We've added a lot, but haven't put together all the documentation for it yet.
Vern