Configuring Bro on Ubuntu 16.04: A powerful tool for network analysis

Introduction

Bro is an open source network analysis framework focusing on network security monitoring. It is the result of 15 years of research and is widely used by universities, research labs, supercomputer centers and many in the open science community. It was developed primarily by the Berkeley International Computer Science Institute and the National Supercomputer Applications Center at the University of Illinois at Urbana-Champaign.

Bro’s features include:

• Bro’s scripting language supports customized monitoring strategies for the site
• For high-performance networks
• The analyzer supports many protocols and can implement advanced semantic analysis at the application level
• It retains rich application layer statistics of the networks it monitors
• Bro can exchange information with other application interfaces in real time
• Its logs comprehensively record all information and provide advanced archiving of network activities

This tutorial will show you how to build from source and install Bro on Ubuntu 16.04 server.

Preparation

Bro has many dependent files:

• Libpcap (http://www.tcpdump.org)
• OpenSSL Library (http://www.openssl.org)
• BIND8 library
• Libz
• Bash (required by BroControl)
• Python 2.6 (required for BroControl)

Building from source also requires:

• CMake 2.8
• Make
• GCC 4.8 or Clang 3.3
• SWIG
• GNU Bison
• Flex
• Libpcap headers
• OpenSSL headers
• zlib headers

Start

First, install all required dependencies by executing the following command:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">apt-get</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> install cmake </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">make</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">gcc</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> g</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">++</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> flex bison libpcap</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dev libssl</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dev python</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dev swig zlib1g</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dev</span>

Install the GeoIP database that locates IP geographical location

Bro uses GeoIP for geolocation. Install IPv4 and IPv6 versions:

<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">wget</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> http</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">:</span><span class="com" style="font-family: Consolas, Monaco, monospace;">//geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">$wget http</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">:</span><span class="com" style="font-family: Consolas, Monaco, monospace;">//geolite.maxmind.com/download/geoip/database/GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz</span>

Unzip these two compressed packages:

<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ gzip </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">d </span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoLiteCity</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">gz</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ gzip </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">-</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">d </span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoLiteCityv6</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">gz</span>

Move the decompressed files to

/usr/share/GeoIP

Under contents:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> mvGeoLiteCity</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">usr</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">share</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoIP</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoIPCity</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat</span>
<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">mv</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoLiteCityv6</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">usr</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">share</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoIP</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="typ" style="font-family: Consolas, Monaco, monospace;">GeoIPCityv6</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">dat</span>

Now, Bro can be built from source.

Build Bro

The latest Bro development version can be obtained through the "git" repository. Execute the following command:

$ git clone --recursive git://git.bro.org/bro

Go to the cloned directory and simply build Bro using the following command:

<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">cd</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> bro</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">./</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">configure</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">$ </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">make</span>
make

The command takes some time to build everything. The exact time depends on the performance of the server.
The "configure" script can be executed with some parameters to specify the dependencies to be built, specifically the "--with-*" options.

Install Bro

Execute in the cloned "bro" directory:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">make</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> install</span>

The default installation path is "/usr/local/bro".

Configuration Bro

Bro's configuration file is located in the "/usr/local/bro/etcV directory. There are three files here:

• node.cfg, used to configure a single node (or multiple nodes) to be monitored.
• broctl.cfg, BroControl configuration file.
• networks.cgf, contains a list of networks represented in CIDR notation.

Configure email settings

Open the "broctl.cfg" configuration file:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> $EDITOR </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">usr</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">etc</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">broctl</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">cfg</span>

View the "Mail Options" option and edit the "MailTo" line as follows:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Recipient</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> address </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">for</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> emails sent out by </span><span class="typ" style="font-family: Consolas, Monaco, monospace;">Bro</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">and</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">BroControl</span>
<span class="typ" style="font-family: Consolas, Monaco, monospace;">MailTo</span> <span class="pun" style="font-family: Consolas, Monaco, monospace;">=</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> admin@example</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">com</span>

Save and close. There are many other options, but in most cases the defaults are good enough.

Select the node to monitor

Out of the box, Bro is configured to run in standalone mode. In this tutorial, we are doing a standalone installation, so no changes are necessary. However, please also look at the "node.cfg" configuration file:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> $EDITOR </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">usr</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">etc</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">node</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">cfg</span>

In the "[bro]" section, you should see something like this:

<span class="pun" style="font-family: Consolas, Monaco, monospace;">[</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">]</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">type</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">=</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">standalone</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">host</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">=</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">localhost</span>
<span class="kwd" style="font-family: Consolas, Monaco, monospace;">interface</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">=</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">eth0</span>

Please make sure "inferface" matches the public network interface of the Ubuntu 16.04 server.
Save and exit.

Configure the network of monitoring nodes

The last file to edit is "network.cfg". Open it with a text editor:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> $EDITOR </span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">usr</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">etc</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">networks</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">cfg</span>

By default, you should see the following:

<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">List</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> of </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> networks </span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">in</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> CIDR notation</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">,</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> optionally followed by a</span>
<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> descriptive tag</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span>
<span class="com" style="font-family: Consolas, Monaco, monospace;">#</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">For</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> example</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">,</span> <span class="str" style="font-family: Consolas, Monaco, monospace;">"10.0.0.0/8"</span> <span class="kwd" style="font-family: Consolas, Monaco, monospace;">or</span> <span class="str" style="font-family: Consolas, Monaco, monospace;">"fe80::/64"</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> are valid prefixes</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span>
<span style="font-family: Consolas, Monaco, monospace;"> </span>
<span class="lit" style="font-family: Consolas, Monaco, monospace;">10.0</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">0.0</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">8</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Private</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> IP space</span>
<span class="lit" style="font-family: Consolas, Monaco, monospace;">172.16</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">0.0</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">12</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Private</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> IP space</span>
<span class="lit" style="font-family: Consolas, Monaco, monospace;">192.168</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">0.0</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">16</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Private</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> IP space</span>

Delete these three entries (this is just an example of how to use this file) and enter the server's public and private IP spaces in the following format:

<span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X </span><span class="typ" style="font-family: Consolas, Monaco, monospace;">Public</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> IP space</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">.</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">X </span><span class="typ" style="font-family: Consolas, Monaco, monospace;">Private</span><span class="pln" style="font-family: Consolas, Monaco, monospace;"> IP space</span>

Save and exit.

Use BroControl to manage Bro installation

Managing Bro requires the use of BroControl, which supports both interactive shell and command line tools. Start the shell:

<span class="com" style="font-family: Consolas, Monaco, monospace;"># /usr/</span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bin</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">broctl</span>

To use the command line tool, just pass the parameters to the previous command, for example:

<span class="com" style="font-family: Consolas, Monaco, monospace;"># /usr/</span><span class="kwd" style="font-family: Consolas, Monaco, monospace;">local</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bro</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">bin</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">/</span><span class="pln" style="font-family: Consolas, Monaco, monospace;">broctl status</span>

This will check the status of Bro by displaying the following output:

<span class="typ" style="font-family: Consolas, Monaco, monospace;">Name</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Type</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Host</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Status</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Pid</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Started</span>
<span class="pln" style="font-family: Consolas, Monaco, monospace;">bro standalone localhost running </span><span class="lit" style="font-family: Consolas, Monaco, monospace;">6807</span> <span class="lit" style="font-family: Consolas, Monaco, monospace;">20</span> <span class="typ" style="font-family: Consolas, Monaco, monospace;">Jul</span> <span class="lit" style="font-family: Consolas, Monaco, monospace;">12</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">:</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">30</span><span class="pun" style="font-family: Consolas, Monaco, monospace;">:</span><span class="lit" style="font-family: Consolas, Monaco, monospace;">50</span>

in conclusion

This is a Bro installation tutorial. We use source-based installation as it is the most efficient way to obtain the latest version available, but the network analysis framework is also available for download in pre-built binary format.
See you next time!

---

The above is the detailed content of Configuring Bro on Ubuntu 16.04: A powerful tool for network analysis. For more information, please follow other related articles on the PHP Chinese website!