[Bro] broctl reading from pcap files

Seth Hall seth at icir.org
Mon Sep 15 05:44:44 PDT 2014


On Sep 15, 2014, at 7:02 AM, Victor-Alexandru Truica <vat at mnworks.dk> wrote:

> - can broctl read from PCAP files?

Yes, look into the "process" command in broctl.

> - can i use BROs cli to save the log files in a SO fashion (timestamped directories and others) without additional bash?

There was a question like that on the mailing list recently.
	http://mailman.icsi.berkeley.edu/pipermail/bro/2014-August/007346.html

The gist is that you need to set a rotation interval and then provide a program which will call to do the actual log rotation.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/





More information about the Bro mailing list