Bro requires no custom hardware, and runs on low-cost commodity PC-style systems. However, the Bro monitoring host must examine every packet into and out of your site, so depending on your site's network traffic, you may need a fairly high-end machine. If you are trying to monitor a link with a large number of connections, we recommend using a second system for report generation, and run only Bro on the packet-capture host.
Item Requirements Processor Note: these are rough estimates. Much depends on the number of connections/second, the types of traffic on your network (e.g., HTTP, FTP, email, etc.), and you can trade off depth of analysis (especially, which protocols are analyzed) for processing load. (See the Performance chapter of the Bro User Guide for more information.)
1 GHz CPU for 100 Mbps monitoring with average packet rate <= 5,000 packets/second
2 GHz CPU for 1 Gbps monitoring with <= 10,000 packets/second
3 GHz CPU for 1 Gbps monitoring with <= 20,000 packets/second
4 GHz CPU for 1 Gbps monitoring with <= 50,000 packets/secondOperating System Recommended: FreeBSD (http://www.freebsd.org/). Bro works with many Unix systems, including Linux and Solaris, but has been primarily tuned for FreeBSD. We recommend using FreeBSD version 4.10 for Bro. If your site has a large number of packets or connections per second you should look at the section on Hardware and OS Tuning. FreeBSD 5.x should work, but has not been tested by the developers. For sites with very high traffic loads, contact us for a FreeBSD 4.x kernel patch to do BPF bonding, which allows merging the two directions of a network link into a single interface as seen by Bro. While Bro can instead merge the two interfaces at user-level, this costs some performance. Memory 512 MB suffices for small networks (say 200 hosts connected via a 100 Mbps link). For larger networks, 1 GB RAM will be required, with 2-3 GB is recommended. Hard disk 10 GB minimum, 50 GB or more for log files recommended. User privileges superuser to install Bro, with Bro then running as user bro. Network Interfaces 3 interfaces are recommended: 2 for packet capture (1 for each direction), and 1 for host management. Capture interfaces should be identical. For some network taps, both directions of the link are captured using the same interface, and the separate host management interface, while prudent, is not required. Other Software - Perl version 5.6 or higher (http://www.perl.org) (for report generation)
- libpcap version 0.7.2 or higher (http://www.tcpdump.org)
Note: Some version of FreeBSD come with older versions of libpcap. Bro recommends newer versions of these tools for performance reasons.
- Apache 1.3 http server (http://httpd.apache.org) (for Bro GUI)
- Python version 2.3 or higher (http://www.python.org) (for Bro GUI)