Bro - Wireshark on steroids for monitoring corporate network attacks in realtime

Impetus · 2014-05-30 19:52:43

There was an interesting netcast covering Bro software on Twit the other day. Bro is an open source, network monitoring tool. Wireshark on steroids. It keeps a database of all traffic in and out on multiple network links (one user has 16 GB of network connection to monitor in real time). At the other extreme one could…

30-05-2014 07:52PM

#1

Impetus

Registered Users, Registered Users 2 Posts: 1,667 ✭✭✭

Join Date: September 2013

Posts: 1346

There was an interesting netcast covering Bro software on Twit the other day. Bro is an open source, network monitoring tool. Wireshark on steroids. It keeps a database of all traffic in and out on multiple network links (one user has 16 GB of network connection to monitor in real time). At the other extreme one could install it on a single client machine.

Bro can track multiple (eg SSH attacks – or whatever you configure it to do) and raise an alarm when it detects someone hacking – even if it is a bot attack originating from a zillion
IP numbers. It has its own script language to configure the required analysis of traffic.

Video of netcast: http://www.podtrac.com/pts/redirect.mp4/twit.cachefly.net/video/floss/floss0296/floss0296_h264m_1280x720_1872.mp4

Audio only: http://www.podtrac.com/pts/redirect.mp3/twit.cachefly.net/audio/floss/floss0296/floss0296.mp3

Overview of Twit IP TV content: http://twit.tv/shows

2