# Bro on other Packet Trace Dumps. **URL:** \ **Category:** Zeek\ **Created:** [March 19, 2005, 3:31am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719 "2005-03-19T03:31:24Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Dana\_Zhang](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@Dana\_Zhang](https://community.zeek.org/u/Dana_Zhang)\ **Post date:** [March 19, 2005, 3:31am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/1 "2005-03-19T03:31:24Z")
Hi, I'm new to bro and what I would like to do is run bro on 38 hours of packet traces that I've aquired from another website. Is there any simple way to do this? I'm a bit confused as how to do this because I don't want to monitor the traffic of my own website/network but analyse data that I extracted from another source. ---
**Author:** ![Christoph\_Goeldi](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Christoph\_Goeldi](https://community.zeek.org/u/Christoph_Goeldi)\ **Post date:** [March 19, 2005, 1:11pm UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/2 "2005-03-19T13:11:36Z")
hi if you have tcpdump files, you can easily do this with the -r flag: > bro -r example.trace brolite see page 9 and the following in the reference manual. have fun christoph ---
**Author:** ![Christoph\_Goeldi](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Christoph\_Goeldi](https://community.zeek.org/u/Christoph_Goeldi)\ **Post date:** [March 22, 2005, 12:54pm UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/3 "2005-03-22T12:54:56Z")
hi dana > Page 9 of the reference manual appears to bea list figures and tables. > I tried to run > \> bro -r example.trace brolite > and it should work if I had a tcpdump file. Unfortunately my trace > file are not in tcpdump format. i'm not sure, but i think that tcpdump is the only format at the moment which can be read by bro. what format do you have? maybe there is a converter around... > On page 18 of the Bro user manual, the following command was suggested > for use with a tcpdump file. > \> bro -r dumpfile brohost i meant page 17 of the pdf file which is page number 9 in the reference manual. (see the number in the right upper corner) by the way if you have installed bro with the commands "./configure", "make", "make install" and "make install-brolite" or similar you can start it with the command > bro -r dumpfile brolite you have to replace the word "brohost" in the command with the name of the policy file you want to load. read more of it in the user and quick start manuals... cheers christoph ---
**Author:** ![Dana\_Zhang](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@Dana\_Zhang](https://community.zeek.org/u/Dana_Zhang)\ **Post date:** [March 28, 2005, 8:35am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/4 "2005-03-28T08:35:10Z")
hi Chris, > i'm not sure, but i think that tcpdump is the only format at the moment which > can be read by bro. > what format do you have? maybe there is a converter around... The current format of my data is just packet headers in binary. I tried to convert to tcpdump format myself. can I confirm that tcpdump format for tcp commections is: src \> dst: flags data-seqno ack window urgent options i'm only working with tcp packets. a couple of examples of my packets are as follows 10.0.0.163.1422 \> 10.0.0.219.80: . 17193851:17193851(0) ack 1278587442 win 8623 10.0.0.7.1202 \> 10.0.0.8.25: P 22414518:22415922(1404) ack 20496183 win 8474 10.0.0.67.4945 \> 10.0.0.66.80: S 2222637079:2222637079(0) win 32696 urg 0 10.0.0.11.26159 \> 10.0.0.12.25: . 868560419:868561879(1460) ack 1691568355 win 61320 However, when I run this file with bro using > bro -r dumpfile brolite I receive the error problem with trace file dumpfile - bad dump file format. Is there something I missed? Cheers, Dana ---
**Author:** ![Christoph\_Goeldi](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Christoph\_Goeldi](https://community.zeek.org/u/Christoph_Goeldi)\ **Post date:** [March 28, 2005, 8:49am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/5 "2005-03-28T08:49:01Z")
hi dana tcpdump is also a binary format. how did you catch your dump? i mean when you catch it with tcpdump you get exactly what you described: packet headers in binary. cheers christoph ---
**Author:** ![Dana\_Zhang](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@Dana\_Zhang](https://community.zeek.org/u/Dana_Zhang)\ **Post date:** [March 28, 2005, 8:59am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/6 "2005-03-28T08:59:24Z")
Hi christoph, are you saying that when this is run: > > bro -r dumpfile brolite dumpfile is a binary file? I thought bro took a tcpdump file and tcpdump outputs files in the format of : src \> dst: flags data-seqno ack window urgent options my packets were captured using a DAG2 system. traces are in DAG format, which is a fixed 64 bytes record format with 40 bytes of IP header. I extracted from my binary to make it look like a tcpdump file. cheers, Dana ---
**Author:** ![Jonathan\_Paisley](https://avatars.discourse-cdn.com/v4/letter/j/f1d935/32.png) [@Jonathan\_Paisley](https://community.zeek.org/u/Jonathan_Paisley)\ **Post date:** [March 28, 2005, 9:40am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/7 "2005-03-28T09:40:48Z")
You can probably use Endace's 'dagconvert' utility to convert from the DAG format to pcap format. pcap format /is/ the tcpdump binary format. You get this if you use the '-w file' option to tcpdump. Otherwise, it just outputs a textual description of the packets. ---
**Author:** ![Christoph\_Goeldi](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Christoph\_Goeldi](https://community.zeek.org/u/Christoph_Goeldi)\ **Post date:** [March 28, 2005, 9:52am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/8 "2005-03-28T09:52:44Z")
hi dana > are you saying that when this is run: > > > > bro -r dumpfile brolite > > dumpfile is a binary file? yes it is! > I thought bro took a tcpdump file and > tcpdump outputs files in the format of : > src \> dst: flags data-seqno ack window urgent options no. tcpdump files are in a binary format. but when you make it visible with the tcpdump command it looks like what you said. > my packets were captured using a DAG2 system. traces are in DAG > format, which is a fixed 64 bytes record format with 40 bytes of IP > header. I extracted from my binary to make it look like a tcpdump > file. what an exotic format! please, go to [http://dag.cs.waikato.ac.nz/](http://dag.cs.waikato.ac.nz/), then enter the download section and get the dag-tools. install it and use the dagbpf command. i didn't check this out, i only made the internet searches for you... what i tell you are basics. maybe you have to read first a bit before come and ask again. have fun christoph ---
**Author:** ![Dana\_Zhang](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@Dana\_Zhang](https://community.zeek.org/u/Dana_Zhang)\ **Post date:** [March 28, 2005, 9:58am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/9 "2005-03-28T09:58:08Z")
I thought I was recreating the textual output that tcpdump would create. I don't understand why bro is telling me there is something wrong with my tcpdump imitation trace file. What exactly should my packet trace file look like? I'm starting to get confused as to what bro accepts. ---
**Author:** ![Jonathan\_Paisley](https://avatars.discourse-cdn.com/v4/letter/j/f1d935/32.png) [@Jonathan\_Paisley](https://community.zeek.org/u/Jonathan_Paisley)\ **Post date:** [March 28, 2005, 10:09am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/10 "2005-03-28T10:09:29Z")
> I thought I was recreating the textual output that tcpdump would > create. I don't understand why bro is telling me there is something > wrong with my tcpdump imitation trace file. This text output is \_not\_ what bro expects. > What exactly should my packet trace file look like? I'm starting to > get confused as to what bro accepts. bro accepts only the tcpdump (aka pcap) \_binary\_ format. Since you have a DAG format trace, you should just be able to use Endace's 'dagconvert' tool to convert to pcap format. You'd do something like:    dagconvert \-T eth:pcap \-i yourfile \-o out\.pcap    bro ... -r out.pcap I've assumed above that you've got legacy Ethernet file format. You may have ERF files from your dag capture, in which case you'd use '-T erf:pcap' in the dagconvert command line. Here's the output from dagconvert -h: $ dagconvert -h dagconvert: DAG file conversion utility. Usage: dagconvert [options]      -d \ DAG device name      -h display help (this page)      -v increase verbosity      -i \ input file      -o \ output file      -r N[k|m|g] change output file after N Bytes.                             k, m, g suffixes for kilobytes, megabytes, gigabytes.      -s \ output snap length      -t \ capture period in seconds      -T \ input and output types (see list of types below)      -A \ output record alignment (ERF only)      -V select variable length output (ERF only)      -F select fixed length output (ERF only)      -G specify GMT offset in seconds (pcap only)      -c 0|16|32 specify number of bits in FCS checksum (pcap only)      -f \ comma separated list of filters (see list of filters below)      -b \ specify a BPF style filter Supported types:      dag ERF direct from DAG device (input only)      erf ERF (extensible record format) file      atm legacy ATM file (input only)      eth legacy Ethernet file (input only)      pos legacy PoS file (input only)      null produces no input or output      pcap libpcap format file (output only)      prt ASCII text packet dump (output only) Supported filters:      rx filter out rx errors (link layer)      ds filter out ds errors (framing)      trunc filter out truncated packets      a,b,c,d filter on indicated interface(s) ---
**Author:** ![Aashish\_Sharma](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Aashish\_Sharma](https://community.zeek.org/u/Aashish_Sharma)\ **Post date:** [March 30, 2005, 8:24pm UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/11 "2005-03-30T20:24:21Z")
This is slightly off topic from the last bro packet trace dump thread. Right now I see bro rolling over bulk trace files as soon as the file size is 2G. (Even though we have large file system support on the os). The issue with this is that all the other log files are also rolled over. I think bro just restarts itself. Is it possible to set up bro to define the size at which bulk trace file should roll over and not have any other log files roll over (even if the bulk trace files roll over at 2G) ? I tried looking in the source and also putting tcpdump like options in the config file for but that does not seem to work. Aashish Sharma ---
**Author:** ![Dana\_Zhang](https://avatars.discourse-cdn.com/v4/letter/d/7ea924/32.png) [@Dana\_Zhang](https://community.zeek.org/u/Dana_Zhang)\ **Post date:** [April 5, 2005, 8:32am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/12 "2005-04-05T08:32:46Z")
Woops. I'll CC it now ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [April 7, 2005, 7:02am UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/13 "2005-04-07T07:02:17Z")
Not right now. You can have the bulk trace file rolled over by setting log\_max\_size and adding its filename to RotateLogs::aux\_files (see rotate-logs.bro). But then log\_max\_size affects all log files for which no explicit size has been defined with &rotate\_size. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-on-other-packet-trace-dumps/719/14 "2022-05-06T15:37:24Z")
Closed on May 6, 2022, 3:37pm UTC