# Bro 1.5.1, FreeBSD, Mirror-Port questions **URL:** \ **Category:** Zeek\ **Created:** [June 3, 2010, 8:34am UTC](https://community.zeek.org/t/bro-1-5-1-freebsd-mirror-port-questions/1631 "2010-06-03T08:34:10Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Thorkill](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@Thorkill](https://community.zeek.org/u/Thorkill)\ **Post date:** [June 3, 2010, 8:34am UTC](https://community.zeek.org/t/bro-1-5-1-freebsd-mirror-port-questions/1631/1 "2010-06-03T08:34:10Z")
Hello List, I am running bro since 0.9 version and I am very happy with it. You do grate job. Currently we need to move BRO to other box where it will monitor the network on a mirror/monitor-port and not as now on a transparent bridge. We configured a mirror/monitor port on our network equipment, we have an gigabit interface without an IP-Address where all traffic is monitored. BRO is monitoring two class-C (/24) networks and is running on FreeBSD-7.1-Release compiled from .tar.gz and not using ports-management. -- Our start policy @load brolite @load site @load file-flush @load ssh redef log\_rotate\_interval = 15 min; redef local\_nets: set[subnet] = { 10.20.20.0/24, 10.20.21.0/24 }; redef interfaces = "em1"; Now what is happening: - bro does see all external and internal connections which are logged in conn.log - bro does see and log some scan attempts - bro does NOT log any SSH-Connections (client/server version) when coming from external but does log some when internal   - it was tested with a policy like this:   event ssh\_client\_version(c: connection, version: string) {      print version;   } - bro does NOT log any sensitive\_URIs when coming from external but does log it when such attempts are internal - bro does NOT log any or just partial informations about FTP/SMTP/HTTP-Requests   - in older versions like 1.1d in example username was logged for FTP now it is just partial for some connections - we do not see any packet drops and packets has been proceeded My question is - it is normal behavior now or something is broken? I would really like to see the traffic/logs on connections from external to internal for FTP/SMTP/HTTP/SSH - any hints? Thank you in advance, thorkill PS. Internal connections means on 10.20.20.0/24 and between those two class-C networks. --- loaded scripts loading /usr/local/bro/share/bro//bro.init    loading /usr/local/bro/share/bro//const.bif.bro    loading /usr/local/bro/share/bro//strings.bif.bro    loading /usr/local/bro/share/bro//bro.bif.bro    loading /usr/local/bro/share/bro//event.bif.bro    loading /usr/local/bro/share/bro//common-rw.bif.bro    loading /usr/local/bro/share/bro//finger-rw.bif.bro    loading /usr/local/bro/share/bro//ftp-rw.bif.bro    loading /usr/local/bro/share/bro//ident-rw.bif.bro    loading /usr/local/bro/share/bro//smtp-rw.bif.bro    loading /usr/local/bro/share/bro//http-rw.bif.bro    loading /usr/local/bro/share/bro//dns-rw.bif.bro    loading /usr/local/bro/share/bro//pcap.bro    loading /usr/local/bro/share/bro//server-ports.bro loading /usr/local/bro/share/bro//brolite.bro    loading /usr/local/bro/share/bro//site.bro    loading /usr/local/bro/share/bro//tcp.bro       loading /usr/local/bro/share/bro//conn.bro          loading /usr/local/bro/share/bro//notice.bro             loading /usr/local/bro/share/bro//drop.bro             loading /usr/local/bro/share/bro//notice-action-filters.bro                loading /usr/local/bro/share/bro//terminate-connection.bro          loading /usr/local/bro/share/bro//hot.bro             loading /usr/local/bro/share/bro//port-name.bro          loading /usr/local/bro/share/bro//netstats.bro          loading /usr/local/bro/share/bro//conn-id.bro    loading /usr/local/bro/share/bro//weird.bro    loading /usr/local/bro/share/bro//frag.bro    loading /usr/local/bro/share/bro//print-resources.bro    loading /usr/local/bro/share/bro//scan.bro       loading /usr/local/bro/share/bro//trw-impl.bro    loading /usr/local/bro/share/bro//trw.bro    loading /usr/local/bro/share/bro//http.bro    loading /usr/local/bro/share/bro//http-request.bro    loading /usr/local/bro/share/bro//http-reply.bro       loading /usr/local/bro/share/bro//http-entity.bro    loading /usr/local/bro/share/bro//software.bro    loading /usr/local/bro/share/bro//ftp.bro       loading /usr/local/bro/share/bro//hot-ids.bro       loading /usr/local/bro/share/bro//ftp-cmd-arg.bro    loading /usr/local/bro/share/bro//portmapper.bro    loading /usr/local/bro/share/bro//tftp.bro       loading /usr/local/bro/share/bro//udp-common.bro    loading /usr/local/bro/share/bro//login.bro       loading /usr/local/bro/share/bro//demux.bro    loading /usr/local/bro/share/bro//irc.bro       loading /usr/local/bro/share/bro//signatures.bro    loading /usr/local/bro/share/bro//blaster.bro    loading /usr/local/bro/share/bro//stepping.bro       loading /usr/local/bro/share/bro//alarm.bro    loading /usr/local/bro/share/bro//synflood.bro    loading /usr/local/bro/share/bro//smtp.bro    loading /usr/local/bro/share/bro//notice-policy.bro    loading /usr/local/bro/share/bro//inactivity.bro    loading /usr/local/bro/share/bro//stats.bro    loading /usr/local/bro/share/bro//rotate-logs.bro loading /var/spool/bro//site/crns.bro    loading /usr/local/bro/share/bro//file-flush.bro    loading /usr/local/bro/share/bro//ssh.bro pcap bufsize = 32768 listening on em1 ---
**Author:** ![Thorkill](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@Thorkill](https://community.zeek.org/u/Thorkill)\ **Post date:** [June 3, 2010, 10:05pm UTC](https://community.zeek.org/t/bro-1-5-1-freebsd-mirror-port-questions/1631/2 "2010-06-03T22:05:49Z")
Hello List, Thorkill wrote: > Hello List, > Currently we need to move BRO to other box where it will monitor the > network on a mirror/monitor-port and not as now on a transparent bridge. > > We configured a mirror/monitor port on our network equipment, we have an > gigabit interface without an IP-Address where all traffic is monitored. It seems that the problem lays on the network - I can not see in example SYN+ACK packets on the mirror port. I made tcpdump-traces at both points - bridge and mirroring-port of the same connection and ran bro on it. -- on mirroring-port 1275600294.796861 2.990471 62.xx.xx.xx 10.20.20.54 ssh 54305 22 tcp 1636 ? SH X cc=1 1275600303.621237 ? 62.xx.xx.xx 10.20.20.54 ssh 55537 22 tcp ? ? S0 X cc=1 -- same connection on bridge 1275599866.464086 2.992575 62.xx.xx.xx 10.20.20.54 ssh 54305 22 tcp 1637 2120 SF X Sorry for the 'false-alarm'. Regards, thorkill ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-1-5-1-freebsd-mirror-port-questions/1631/3 "2022-05-06T15:39:07Z")