adtrace

Makefile and source for the adtrace utility. This program is used in conjunction with the localnetMAC.pl perl script to compute the network address that compose the internal and extern nets that bro is monitoring. This program when run by itself just reads a pcap (tcpcump) file and writes out the src MAC, dst MAC, src IP, dst IP for each packet seen in the file. This output is processed by the localnetMAC.pl script during ‘make install’.

devel-tools

A set of scripts used commonly for Bro development.

extract-conn-by-uid:

Extracts a connection from a trace file based on its UID found in Bro’s conn.log

gen-mozilla-ca-list.rb

Generates list of Mozilla SSL root certificates in a format readable by Bro.

update-changes

A script to maintain the CHANGES and VERSION files.

git-show-fastpath

Show commits to the fastpath branch not yet merged into master.

cpu-bench-with-trace

Run a number of Bro benchmarks on a trace file.

nftools

Utilities for dealing with Bro’s custom file format for storing NetFlow records. nfcollector reads NetFlow data from a socket and writes it in Bro’s format. ftwire2bro reads NetFlow “wire” format (e.g., as generated by a ‘flow-export’ directive) and writes it in Bro’s format.

rst

Makefile and source for the rst utility. “rst” can be invoked by a Bro script to terminate an established TCP connection by forging RST tear-down packets. See terminate_connection() in conn.bro.