mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Add man page for Bro
This commit is contained in:
Daniel Thayer
parent
fe9e7d015e
commit
e4c9c58b9e
3 changed files with 171 additions and 0 deletions
|
|
@ -15,6 +15,11 @@ if (NOT BRO_SCRIPT_INSTALL_PATH)
|
||||||
set(BRO_SCRIPT_INSTALL_PATH ${BRO_ROOT_DIR}/share/bro)
|
set(BRO_SCRIPT_INSTALL_PATH ${BRO_ROOT_DIR}/share/bro)
|
||||||
endif ()
|
endif ()
|
||||||
|
|
||||||
|
if (NOT BRO_MAN_INSTALL_PATH)
|
||||||
|
# set the default Bro man page installation path (user did not specify one)
|
||||||
|
set(BRO_MAN_INSTALL_PATH ${BRO_ROOT_DIR}/share/man)
|
||||||
|
endif ()
|
||||||
|
|
||||||
# sanitize the Bro script install directory into an absolute path
|
# sanitize the Bro script install directory into an absolute path
|
||||||
# (CMake is confused by ~ as a representation of home directory)
|
# (CMake is confused by ~ as a representation of home directory)
|
||||||
get_filename_component(BRO_SCRIPT_INSTALL_PATH ${BRO_SCRIPT_INSTALL_PATH}
|
get_filename_component(BRO_SCRIPT_INSTALL_PATH ${BRO_SCRIPT_INSTALL_PATH}
|
||||||
|
|
@ -175,6 +180,7 @@ include_directories(${CMAKE_CURRENT_BINARY_DIR})
|
||||||
add_subdirectory(src)
|
add_subdirectory(src)
|
||||||
add_subdirectory(scripts)
|
add_subdirectory(scripts)
|
||||||
add_subdirectory(doc)
|
add_subdirectory(doc)
|
||||||
|
add_subdirectory(man)
|
||||||
|
|
||||||
include(CheckOptionalBuildSources)
|
include(CheckOptionalBuildSources)
|
||||||
|
|
||||||
|
|
|
||||||
5
man/CMakeLists.txt
Normal file
5
man/CMakeLists.txt
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
|
||||||
|
install(DIRECTORY . DESTINATION ${BRO_MAN_INSTALL_PATH}/man8 FILES_MATCHING
|
||||||
|
PATTERN "*.8"
|
||||||
|
)
|
||||||
|
|
||||||
160
man/bro.8
Normal file
160
man/bro.8
Normal file
|
|
@ -0,0 +1,160 @@
|
||||||
|
.TH BRO "8" "November 2014" "bro" "System Administration Utilities"
|
||||||
|
.SH NAME
|
||||||
|
bro \- passive network traffic analyzer
|
||||||
|
.SH SYNOPSIS
|
||||||
|
.B bro
|
||||||
|
\/\fP [options] [file ...]
|
||||||
|
.SH DESCRIPTION
|
||||||
|
Bro is primarily a security monitor that inspects all traffic on a link in
|
||||||
|
depth for signs of suspicious activity. More generally, however, Bro
|
||||||
|
supports a wide range of traffic analysis tasks even outside of the
|
||||||
|
security domain, including performance measurements and helping with
|
||||||
|
trouble-shooting.
|
||||||
|
|
||||||
|
Bro comes with built-in functionality for a range of analysis and detection
|
||||||
|
tasks, including detecting malware by interfacing to external registries,
|
||||||
|
reporting vulnerable versions of software seen on the network, identifying
|
||||||
|
popular web applications, detecting SSH brute-forcing, validating SSL
|
||||||
|
certificate chains, among others.
|
||||||
|
.SH OPTIONS
|
||||||
|
.TP
|
||||||
|
.B <file>
|
||||||
|
policy file, or read stdin
|
||||||
|
.TP
|
||||||
|
\fB\-a\fR,\ \-\-parse\-only
|
||||||
|
exit immediately after parsing scripts
|
||||||
|
.TP
|
||||||
|
\fB\-b\fR,\ \-\-bare\-mode
|
||||||
|
don't load scripts from the base/ directory
|
||||||
|
.TP
|
||||||
|
\fB\-d\fR,\ \-\-debug\-policy
|
||||||
|
activate policy file debugging
|
||||||
|
.TP
|
||||||
|
\fB\-e\fR,\ \-\-exec <bro code>
|
||||||
|
augment loaded policies by given code
|
||||||
|
.TP
|
||||||
|
\fB\-f\fR,\ \-\-filter <filter>
|
||||||
|
tcpdump filter
|
||||||
|
.TP
|
||||||
|
\fB\-g\fR,\ \-\-dump\-config
|
||||||
|
dump current config into .state dir
|
||||||
|
.TP
|
||||||
|
\fB\-h\fR,\ \-\-help|\-?
|
||||||
|
command line help
|
||||||
|
.TP
|
||||||
|
\fB\-i\fR,\ \-\-iface <interface>
|
||||||
|
read from given interface
|
||||||
|
.TP
|
||||||
|
\fB\-p\fR,\ \-\-prefix <prefix>
|
||||||
|
add given prefix to policy file resolution
|
||||||
|
.TP
|
||||||
|
\fB\-r\fR,\ \-\-readfile <readfile>
|
||||||
|
read from given tcpdump file
|
||||||
|
.TP
|
||||||
|
\fB\-y\fR,\ \-\-flowfile <file>[=<ident>]
|
||||||
|
read from given flow file
|
||||||
|
.TP
|
||||||
|
\fB\-Y\fR,\ \-\-netflow <ip>:<prt>[=<id>]
|
||||||
|
read flow from socket
|
||||||
|
.TP
|
||||||
|
\fB\-s\fR,\ \-\-rulefile <rulefile>
|
||||||
|
read rules from given file
|
||||||
|
.TP
|
||||||
|
\fB\-t\fR,\ \-\-tracefile <tracefile>
|
||||||
|
activate execution tracing
|
||||||
|
.TP
|
||||||
|
\fB\-w\fR,\ \-\-writefile <writefile>
|
||||||
|
write to given tcpdump file
|
||||||
|
.TP
|
||||||
|
\fB\-v\fR,\ \-\-version
|
||||||
|
print version and exit
|
||||||
|
.TP
|
||||||
|
\fB\-x\fR,\ \-\-print\-state <file.bst>
|
||||||
|
print contents of state file
|
||||||
|
.TP
|
||||||
|
\fB\-z\fR,\ \-\-analyze <analysis>
|
||||||
|
run the specified policy file analysis
|
||||||
|
.TP
|
||||||
|
\fB\-C\fR,\ \-\-no\-checksums
|
||||||
|
ignore checksums
|
||||||
|
.TP
|
||||||
|
\fB\-D\fR,\ \-\-dfa\-size <size>
|
||||||
|
DFA state cache size
|
||||||
|
.TP
|
||||||
|
\fB\-F\fR,\ \-\-force\-dns
|
||||||
|
force DNS
|
||||||
|
.TP
|
||||||
|
\fB\-I\fR,\ \-\-print\-id <ID name>
|
||||||
|
print out given ID
|
||||||
|
.TP
|
||||||
|
\fB\-K\fR,\ \-\-md5\-hashkey <hashkey>
|
||||||
|
set key for MD5\-keyed hashing
|
||||||
|
.TP
|
||||||
|
\fB\-L\fR,\ \-\-rule\-benchmark
|
||||||
|
benchmark for rules
|
||||||
|
.TP
|
||||||
|
\fB\-N\fR,\ \-\-print\-plugins
|
||||||
|
print available plugins and exit (\fB\-NN\fR for verbose)
|
||||||
|
.TP
|
||||||
|
\fB\-O\fR,\ \-\-optimize
|
||||||
|
optimize policy script
|
||||||
|
.TP
|
||||||
|
\fB\-P\fR,\ \-\-prime\-dns
|
||||||
|
prime DNS
|
||||||
|
.TP
|
||||||
|
\fB\-R\fR,\ \-\-replay <events.bst>
|
||||||
|
replay events
|
||||||
|
.TP
|
||||||
|
\fB\-S\fR,\ \-\-debug\-rules
|
||||||
|
enable rule debugging
|
||||||
|
.TP
|
||||||
|
\fB\-T\fR,\ \-\-re\-level <level>
|
||||||
|
set 'RE_level' for rules
|
||||||
|
.TP
|
||||||
|
\fB\-U\fR,\ \-\-status\-file <file>
|
||||||
|
Record process status in file
|
||||||
|
.TP
|
||||||
|
\fB\-W\fR,\ \-\-watchdog
|
||||||
|
activate watchdog timer
|
||||||
|
.TP
|
||||||
|
\fB\-X\fR,\ \-\-broxygen
|
||||||
|
generate documentation based on config file
|
||||||
|
.TP
|
||||||
|
\fB\-\-pseudo\-realtime[=\fR<speedup>]
|
||||||
|
enable pseudo\-realtime for performance evaluation (default 1)
|
||||||
|
.TP
|
||||||
|
\fB\-\-load\-seeds\fR <file>
|
||||||
|
load seeds from given file
|
||||||
|
.TP
|
||||||
|
\fB\-\-save\-seeds\fR <file>
|
||||||
|
save seeds to given file
|
||||||
|
.SH ENVIRONMENTS
|
||||||
|
.TP
|
||||||
|
.B BROPATH
|
||||||
|
file search path (.:/usr/share/bro:/usr/share/bro/policy:/usr/share/bro/site)
|
||||||
|
.TP
|
||||||
|
.B BRO_PREFIXES
|
||||||
|
prefix list ()
|
||||||
|
.TP
|
||||||
|
.B BRO_DNS_FAKE
|
||||||
|
disable DNS lookups (off)
|
||||||
|
.TP
|
||||||
|
.B BRO_SEED_FILE
|
||||||
|
file to load seeds from (not set)
|
||||||
|
.TP
|
||||||
|
.B BRO_LOG_SUFFIX
|
||||||
|
ASCII log file extension (.log)
|
||||||
|
.TP
|
||||||
|
.B BRO_PROFILER_FILE
|
||||||
|
Output file for script execution statistics (not set)
|
||||||
|
.TP
|
||||||
|
.B BRO_DISABLE_BROXYGEN
|
||||||
|
Disable Broxygen documentation support (not set)
|
||||||
|
.IP
|
||||||
|
Supported log formats: Ascii,SQLite
|
||||||
|
.SH AUTHOR
|
||||||
|
.B bro
|
||||||
|
was written by The Bro Project <info@bro.org>.
|
||||||
|
.PP
|
||||||
|
This manual page was written by Raúl Benencia <rul@kalgan.cc>
|
||||||
|
for the Debian project (but may be used by others).
|
||||||
Loading…
Add table
Add a link
Reference in a new issue