# Bro and NetFlow

**URL:** <https://community.zeek.org/t/bro-and-netflow/1400>\
**Category:** Zeek\
**Created:** [October 9, 2008, 10:07pm UTC](https://community.zeek.org/t/bro-and-netflow/1400 "2008-10-09T22:07:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Feren](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Andrew\_Feren](https://community.zeek.org/u/Andrew_Feren)\
**Post date:** [October 9, 2008, 10:07pm UTC](https://community.zeek.org/t/bro-and-netflow/1400/1 "2008-10-09T22:07:30Z")

</div>

I built 1.4.prerelease.12 the other day to play around with several parts of Bro including the NetFlow policies. I'm having good luck with the rest of my investigations, but I can't seem to get Bro to react to the NetFlow that is coming in.

I get a netflow.log file, but nothing ever gets logged.

NetFlow Version is 5.

I read through the policies and .pac files and I don't see a problem, but I'm new to Bro and there is a lot to sort through.

Any thoughts on where I should start?

-Andrew

---

<div class="post-metadata">

**Author:** ![Bernhard\_Ager](https://avatars.discourse-cdn.com/v4/letter/b/35a633/32.png) [@Bernhard\_Ager](https://community.zeek.org/u/Bernhard_Ager)\
**Post date:** [October 10, 2008, 10:08am UTC](https://community.zeek.org/t/bro-and-netflow/1400/2 "2008-10-10T10:08:31Z")

</div>

I assume you are trying to extract netflow data from a dumped trace or  
by sniffing on a network device. However the Bro NetFlow support is an  
IO source, which either listens for incoming flows on a UDP socket or  
reads flows from a file. You find the details in the current CHANGES  
file \<[http://svn.icir.org/bro/trunk/bro/CHANGES](http://svn.icir.org/bro/trunk/bro/CHANGES)\>. Especially read the  
subsection about "auxiliary programs" in case you want to use files as  
input.

Regards,  
&nbsp;&nbsp;Bernhard

---

<div class="post-metadata">

**Author:** ![Andrew\_Feren](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Andrew\_Feren](https://community.zeek.org/u/Andrew_Feren)\
**Post date:** [October 10, 2008, 8:13pm UTC](https://community.zeek.org/t/bro-and-netflow/1400/3 "2008-10-10T20:13:06Z")

</div>

Command line is

> `bro -i eth0 ACF.bro`

ACF.bro is attached. The rest of my config is currently unmodified. I could write the NetFlow to a tcpdump file. I hadn’t thought to try the -r switch. Thanks for the idea.

-Andrew

rmkml wrote:

[ACF.bro](https://community.zeek.org/uploads/short-url/4lZSBUCblZNoCn9xpGQGaH95UBH.bro) (229 Bytes)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bro-and-netflow/1400/4 "2022-05-06T15:38:41Z")

</div>

Closed on May 6, 2022, 3:38pm UTC