Bro 2.5 Beta available

Zeek
1

The beta version for Bro 2.5 is now available for testing and can be
downloaded at:

         https://bro.org/download/index.html

Binary packages also are available at:

         https://bro.org/download/beta-packages.html

Some of the notable changes since the 2.4 release are:

- Bro now includes the NetControl framework. This framework allows easy
   interaction with hard- and software switches, firewalls, etc.

- Support for the SMB protocol (SMB1 and SMB2), including GSSAPI and NTLM.

- Support for the remote framebuffer protocol (RFB), that is used by VNC
   servers for remote graphical display.

- The Intelligence framework was refactored and extended. It now supports, for
   example subnet indicators and item deletion/expiration.

For more information see the NEWS and CHANGES files:
https://www.bro.org/documentation/beta/NEWS.bro.html
https://www.bro.org/documentation/beta/CHANGES.bro.txt

Feel free to use this mailing list or the bug tracker (tracker.bro.org) to
provide feedback or report problems.

Johanna

2

Thx all for awesome Bro project!

Could you check if BIT-1562 (lock on old pcap file) fix is present on 2.5 beta version please ?
(because first test repeat lock)

Best Regards
@Rmkml

3

Yes.. this was fixed back in May. What do you mean by "first test repeat lock" ? Which pcap did you test on which bro version?

[jazoff@bro-test tmp]$ bro --version
bro version 2.5-beta

[jazoff@bro-test tmp]$ time bro -r bro241lock.pcap
1243601416.209199 warning in /usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line 54: Your trace file likely has invalid IP checksums, most likely from NIC checksum offloading. By default, packets with invalid checksums are discarded by Bro unless using the -C command-line option or toggling the 'ignore_checksums' variable. Alternatively, disable checksum offloading by the network adapter to ensure Bro analyzes the actual checksums that are transmitted.

real 0m1.157s
user 0m1.079s
sys 0m0.050s

[jazoff@bro-test tmp]$ time bro -C -r bro241lock.pcap

real 0m0.936s
user 0m0.863s
sys 0m0.048s

4

Thx Justin,
I am wrong, it's my bad, sorry for noise.
Happy Bro Testing
@Rmkml