# Bro beta install

**URL:** <https://community.zeek.org/t/bro-beta-install/5525>\
**Category:** Zeek\
**Created:** [November 12, 2018, 7:52pm UTC](https://community.zeek.org/t/bro-beta-install/5525 "2018-11-12T19:52:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 12, 2018, 7:52pm UTC](https://community.zeek.org/t/bro-beta-install/5525/1 "2018-11-12T19:52:19Z")

</div>

Wow what a complete disaster this was. Errors:

fatal error in /usr/local/bro/share/bro/base/init-bare.bro, line 1: cannot load plugin library /usr/local/bro/lib/bro/plugins/packages/Bro\_AF\_Packet//lib/Bro-AF\_Packet.linux-x86\_64.so: /usr/local/bro/lib/bro/plugins/packages/Bro\_AF\_Packet//lib/Bro-AF\_Packet.linux-x86\_64.so: undefined symbol: \_ZN6plugin6Plugin12HookLoadFileERKNSt7\_\_cxx1112basic\_stringIcSt11char\_traitsIcESaIcEEES8\_

warning in /usr/local/bro/share/bro/policy/protocols/smb/\_\_load\_\_.bro, line 1: deprecated script loaded from /usr/local/bro/share/bro/site/local.bro:98 "Use '@load base/protocols/smb' instead"

error in /usr/local/bro/share/bro/base/bif/plugins/./Bro\_SSL.events.bif.bro, line 41 and /usr/local/bro/share/bro/site/packages/./ja3/./ja3.bro, line 118: incompatible types (event(c:connection; version:count; record\_version:count; possible\_ts:tme; client\_random:string; session\_id:string; ciphers:vector of count; comp\_methods:vector of count;) and event(c:connection; version:count; possible\_ts:time; client\_random:string; session\_id:string; ciphers:vector of count;))

and my redef line below:  
redef Communication::listen\_interface = 127.0.0.1;

gets me:  
error in /usr/local/bro/share/bro/site/local.bro, line 102: "redef" used but not previously defined (Communication::listen\_interface)

reverted back to 2.5.5 now....yeesh.

James

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [November 12, 2018, 9:34pm UTC](https://community.zeek.org/t/bro-beta-install/5525/2 "2018-11-12T21:34:51Z")

</div>

> Wow what a complete disaster this was. Errors:
> 
> fatal error in /usr/local/bro/share/bro/base/init-bare.bro, line 1:  
> cannot load plugin library  
> /usr/local/bro/lib/bro/plugins/packages/Bro\_AF\_Packet//lib/Bro-AF\_Packet.linux-x86\_64.so:  
> /usr/local/bro/lib/bro/plugins/packages/Bro\_AF\_Packet//lib/Bro-AF\_Packet.linux-x86\_64.so:  
> undefined symbol:  
> \_ZN6plugin6Plugin12HookLoadFileERKNSt7\_\_cxx1112basic\_stringIcSt11char\_traitsIcESaIcEEES8\_

May need to recompile the plugin against new Bro version?

> warning in /usr/local/bro/share/bro/policy/protocols/smb/\_\_load\_\_.bro,  
> line 1: deprecated script loaded from  
> /usr/local/bro/share/bro/site/local.bro:98 "Use '@load  
> base/protocols/smb' instead"

It's only warning, but you can just update local.bro as indicated.

> error in  
> /usr/local/bro/share/bro/base/bif/plugins/./Bro\_SSL.events.bif.bro, line  
> 41 and /usr/local/bro/share/bro/site/packages/./ja3/./ja3.bro, line 118:  
> incompatible types (event(c:connection; version:count;  
> record\_version:count; possible\_ts:tme; client\_random:string;  
> session\_id:string; ciphers:vector of count; comp\_methods:vector of  
> count;) and event(c:connection; version:count; possible\_ts:time;  
> client\_random:string; session\_id:string; ciphers:vector of count;))

This will need to be fixed in the ja3 package. I have a PR open now:

> <https://github.com/salesforce/ja3/pull/27>
>
> Some SSL event definitions will change in upcoming Bro 2.6. This PR should chan…ge the event handlers to be compatible with that as well as still work with older versions.

So either wait for that to get merged and then update the local  
package or use my fork/patch directly if eager to try Bro 2.6-beta.

> and my redef line below:  
> redef Communication::listen\_interface = 127.0.0.1;
> 
> gets me:  
> error in /usr/local/bro/share/bro/site/local.bro, line 102: "redef" used  
> but not previously defined (Communication::listen\_interface)

The equivalent functionality is now:

&nbsp;&nbsp;&nbsp;&nbsp;redef Broker::default\_listen\_address = "127.0.0.1";

(The underlying communication systems in Bro have been completely  
replaced with a new library called "Broker").

> reverted back to 2.5.5 now....yeesh.

There's quite a few potential incompatibilities with upcoming Bro 2.6,  
so worth seeing release notes:

[https://www.bro.org/sphinx-git/install/release-notes.html](https://www.bro.org/sphinx-git/install/release-notes.html)

Generally a hope is that future releases minimize breakages for users,  
but there were some big fundamental changes that made it hard to avoid  
for 2.6.

Let me know if you give it another shot and have further trouble.

- Jon

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 20, 2018, 9:55pm UTC](https://community.zeek.org/t/bro-beta-install/5525/3 "2018-11-20T21:55:36Z")

</div>

Wow this took me forever to get back to. Thank you...will wait a bit and see how the beta progresses.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-beta-install/5525/4 "2022-05-06T15:46:11Z")

</div>

Closed on May 6, 2022, 3:46pm UTC


