Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

First pass at cleaning up documented dependencies.

Browse source
This commit is contained in:
Jon Siwek 2010-10-19 16:12:15 -05:00
parent 87a74912b7
commit 4e4a18f3af
1 changed files with 34 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

70
INSTALL
View file

@ -1,61 +1,59 @@
Prerequisites Prerequisites
============= =============
Bro relies on the following libraries and tools, which need to be installed Bro-aux relies on the following libraries and tools, which need to be installed
before you begin with the installation: before you begin with the installation:
* Libpcap * Libpcap headers and libraries
If libpcap is already installed on the system, by default Bro Network traffic capture library
will use that one. Otherwise, it falls back to a version shipped
with the Bro distribution.
* Flex * Flex
Flex is already installed on most systems, so with luck you can Flex is already installed on most systems, so with luck you can
skip having to install it yourself. skip having to install it yourself.
* Bison or byacc * Bison
These come with many systems, but if you get errors compiling This comes with many systems, but if you get errors compiling
parse.y, you will need to install them. bison is available parse.y, you will need to install it.
from GNU sites such as ftp.gnu.org.
* BIND8 headers and libraries * BIND8 headers and libraries
These are usually already installed as well. These are usually already installed as well.
* Autotools * OpenSSL headers and libraries
If you have checked the source out from Bro's Subversion For analysis of SSL certificates by the HTTP analyzer, and
repository, you need the autotools suite installed. In this for encrypted Bro-to-Bro communication. These are likely installed,
case, run "./autogen.sh" first right after the check out. though some platforms may require installation of a 'devel' package
Otherwise the installation steps below will fail. for the headers.
* CMake 2.8 or greater
CMake is a cross-platform, open-source build system, typically
not installed by default. See http://www.cmake.org for more
information regarding CMake and the installation steps below for
how to use it to build this distribution.
Bro can also make uses of some optional libraries if they are found at Bro can also make uses of some optional libraries if they are found at
installation time: installation time:
* OpenSSL
For analysis of SSL certificates by the HTTP analyzer, and
for encrypted Bro-to-Bro communication.
* Libmagic * Libmagic
For identifying file types (e.g., in FTP transfers). For identifying file types (e.g., in FTP transfers).
* LibGeoIP * LibGeoIP
For geo-locating IP addresses. For geo-locating IP addresses.
* Libz * Libz
For decompressing HTTP bodies by the HTTP analyzer, and for For decompressing HTTP bodies by the HTTP analyzer, and for
compressed Bro-to-Bro communication. compressed Bro-to-Bro communication.
* Endace's DAG tools: * Endace's DAG tools:
For native support of Endace DAG cards. For native support of Endace DAG cards.
Installation Installation
============ ============
To build and install into /usr/local: To build and install into /usr/local:
> ./configure > ./configure
> make > make
> make install > make install
This will install the Bro binary into /usr/local/bin/bro and the policy This will install the Bro binary into /usr/local/bin/bro and the policy
files into /usr/local/share/bro. files into /usr/local/share/bro.
@ -77,17 +75,17 @@ http://www.bro-ids.org/wiki for more information.
To run a policy file from /usr/local/share/bro, such as mt.bro, on a To run a policy file from /usr/local/share/bro, such as mt.bro, on a
previously captured tcpdump save file named foo: previously captured tcpdump save file named foo:
bro -r foo mt.bro bro -r foo mt.bro
To run from interface le0: To run from interface le0:
bro -i le0 mt bro -i le0 mt
You can alternatively specify interface and scripts to load in your own You can alternatively specify interface and scripts to load in your own
policy file: policy file:
@load mt @load mt
redef interfaces = "le0"; redef interfaces = "le0";
and then run and then run
@ -95,10 +93,10 @@ and then run
You can see the BPF filter Bro will use (if not overridden) by executing You can see the BPF filter Bro will use (if not overridden) by executing
bro mt print-filter bro mt print-filter
To run interactively (e.g., for playing with expression evaluation): To run interactively (e.g., for playing with expression evaluation):
bro bro
"bro -h" lists the various options. "bro -h" lists the various options.