# Bro 2.0 Beta is out!

**URL:** <https://community.zeek.org/t/bro-2-0-beta-is-out/2081>\
**Category:** Zeek\
**Created:** [October 28, 2011, 9:34pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081 "2011-10-28T21:34:14Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [October 28, 2011, 9:34pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/1 "2011-10-28T21:34:14Z")

</div>

We are very excited to announce a public beta of Bro 2.0! Please give  
it a try and let us know what you think. More information here:

&nbsp;&nbsp;&nbsp;&nbsp;[http://blog.bro-ids.org/2011/10/public-beta-of-bro-20-released.html](http://blog.bro-ids.org/2011/10/public-beta-of-bro-20-released.html)

Thanks to everybody who worked on this, it shaped up really nicely I  
think!

Robin

---

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [October 28, 2011, 11:22pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/2 "2011-10-28T23:22:22Z")

</div>

Just installed Bro 2.0 Beta on Redhat 5.7. I had to change a few line of the broctl script of the form:

&nbsp;&nbsp;&nbsp;proc.fromchild = proc.stdout if proc.stdout != None else []

The version of python on Readhat 5.7, Python 2.4.3, cann't handle this type of construct.

Which versions of python was used to develop Bro 2.0 Beta?

Bill Jones

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [October 28, 2011, 11:37pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/3 "2011-10-28T23:37:57Z")

</div>

Yeah, it needs Python 2.6 right now. If we can make it 2.4-compatible  
with just a few small tweaks, that sounds worth it. We did already do  
that for some of the other Python code in the package.

So if with your changes you find it to work fine with 2.4, could you  
file a patch with the tracker?

Thanks,

Robin

---

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [October 28, 2011, 11:42pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/4 "2011-10-28T23:42:29Z")

</div>

The new log formats are a lot easier to read.

There are quite a few new check that are going to be very user full.

Thanks to every for all the work that you put into this version of bro. It is really quite nice!

---

<div class="post-metadata">

**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\
**Post date:** [October 29, 2011, 12:58am UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/5 "2011-10-29T00:58:49Z")

</div>

Sure I can do a patch.

Are there any scripts like the old stats.bro scrip that will print packets processed.

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [October 29, 2011, 4:50am UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/6 "2011-10-29T04:50:40Z")

</div>

> The new log formats are a lot easier to read.

Don't forget to check out the new log processing tool bro-cut in the aux  
directory:

&nbsp;&nbsp;&nbsp;&nbsp;bro-cut [options] \<columns\>

&nbsp;&nbsp;&nbsp;&nbsp;Extracts the given columns from an ASCII Bro log on standard input. By  
&nbsp;&nbsp;&nbsp;&nbsp;default, bro-cut does not include format header blocks into the output.

&nbsp;&nbsp;&nbsp;&nbsp;Example: cat conn.log | bro-cut -d ts id.orig\_h id.orig\_p

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-c Include the first format header block into the output.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-C Include all format header blocks into the output.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-d Convert time values into human-readable format (needs gawk).  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-D \<fmt\> Like -d, but specify format for time (see strtime(3) for syntax).

&nbsp;&nbsp;&nbsp;&nbsp;For the time conversion, the format string can also be specified by setting  
&nbsp;&nbsp;&nbsp;&nbsp;an environment variable BRO\_CUT\_TIMEFMT.

Here are some more examples (output abbreviated):

&nbsp;&nbsp;&nbsp;&nbsp;% bro-cut ts id.orig\_h id.resp\_p \< conn.log  
&nbsp;&nbsp;&nbsp;&nbsp;1319742168.465601 192.150.187.147 80  
&nbsp;&nbsp;&nbsp;&nbsp;1319742167.737945 192.150.187.147 80

&nbsp;&nbsp;&nbsp;&nbsp;% bro-cut host uri \< http.log | awk '{ print $1$2 }'  
&nbsp;&nbsp;&nbsp;&nbsp;s0.2mdn.net/879366/flashwrite\_1\_2.js  
&nbsp;&nbsp;&nbsp;&nbsp;maps.google.com/mapfiles/home3.html

&nbsp;&nbsp;&nbsp;&nbsp;% bro-cut -d ts \< conn.log  
&nbsp;&nbsp;&nbsp;&nbsp;2011-10-27T12:02:48-0700

&nbsp;&nbsp;&nbsp;&nbsp;% bro-cut -D '%s' ts orig\_bytes resp\_bytes \  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\< conn.log \  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\> sort -n \  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\> awk '{ if ($1 == ts) { size+=$2+$3 } \  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else { if (size != 0) print $1, size; \  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ts=$1; size=0 } }'  
&nbsp;&nbsp;&nbsp;&nbsp;1319742168 33628  
&nbsp;&nbsp;&nbsp;&nbsp;1319742169 22814

Enjoy,

&nbsp;&nbsp;&nbsp;&nbsp;Matthias

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [November 1, 2011, 3:58am UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/7 "2011-11-01T03:58:05Z")

</div>

No, I don't think we have an equivalent for that right now. But that  
would be good to add.

Robin

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [November 1, 2011, 4:15am UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/8 "2011-11-01T04:15:56Z")

</div>

Hm, I totally missed that one. I'll work on it after the workshop, it should be fairly easy and really belongs in 2.0 anyway.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-2-0-beta-is-out/2081/9 "2022-05-06T15:39:56Z")

</div>