Previous: Network Tap, Up: Requirements



2.2 Hardware and Software Requirements

Bro requires no custom hardware, and runs on low-cost commodity PC-style system. However, the Bro monitoring host must examine every packet into and out of your site, so depending on your sites network traffic, you may need a fairly high-end machine. If you are trying to monitor a link with a large number of connections, we recommend using a second system for report generation, and run only Bro on the capture host.

Item Requirements


Processor 1 GHz CPU (for 100 BT Ethernet with average packet rate <= 5,000 packets/second)
2 GHz CPU (for 1000 BT Ethernet with average packet rate <= 10,000 packets/second)
3 GHz CPU (for 1000 BT Ethernet with average packet rate <= 20,000 packets/second)
4 GHz CPU (for 1000 BT Ethernet with average packet rate <= 50,000 packets/second)
(Note: these are very rough estimates, and much depends on the types of traffic on your network (e.g.: http, ftp, mail, etc.). See the Performance chapter of the Bro User Guide for more information)


Operating System FreeBSD 4.10 (http://www.freebsd.org/) Bro works with Linux and Solaris as well, but the performance is best under FreeBSD. In particular there are some performance issues with packet capture under Linux. See the User Guide chapter on Bro and Linux for more information. FreeBSD 5.x should work, but may have performance issues. For sites with very high traffic loads, contact us for information on a FreeBSD 4.x patch to do bpf bonding


Memory 1 GB RAM is the minimum needed, but 2-3 GB is recommended


Hard disk 10 GByte minimum, 50 GByte or more for log files recommended


User privileges superuser to install Bro, then Bro runs as user bro


Network Interfaces 3 interfaces are required: 2 for packet capture (1 for each direction), and 1 for host management. Capture interfaces should be identical.


Other Software - Apache 1.3 http server (http://httpd.apache.org)
- Perl version 5.6 or higher (http://www.perl.org)
- libpcap version 0.8 or higher (http://www.tcpdump.org)
- tcpdump version 3.8 or higher (http://www.tcpdump.org)
Note: FreeBSD comes with older versions perl, libpcap, and tcpdump. Bro requires newer versions of these tools.