# Documentation and getting started. **URL:** \ **Category:** Zeek\ **Created:** [October 16, 2017, 4:49pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062 "2017-10-16T16:49:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sniper](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@Sniper](https://community.zeek.org/u/Sniper)\ **Post date:** [October 16, 2017, 4:49pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/1 "2017-10-16T16:49:10Z")
Hello Everyone, Is there reference page on all the default installation directory locations are by any chance? $PREFIX just makes it a very long process establishing where all the files are located. If not, I think this would be excellent for beginners like me. Also, I have created a bridge interface that I want to monitor using ubuntu/bro by connecting two hosts, for some reason I can't seem to generate any logs in /usr/local/bro/logs/ (no 'current' folder when bro is started as in the documentation). Is this even possible to monitor a bridge interface using bro on the same host? I have already changed node.cfg interface to br0. There are no tutorials nowhere on how to actually get started, tried to follow the instructions but still no luck, ive been wasting days on this. If someone could point me in the right direction i'll greatly appreciate it. Kind regards Daniel ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [October 16, 2017, 7:20pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/2 "2017-10-16T19:20:28Z")
Hi Daniel: Check this link for info on​ ​ the bro directory structure that may help you: [https://www.bro.org/sphinx/install/release-notes.html#script-organization](https://www.bro.org/sphinx/install/release-notes.html#script-organization) ​As far as monitoring a bridged interface, there should be no problem, as long as bro can access the interface. ​If you’re not running as root, see: [https://www.bro.org/documentation/faq.html#how-can-i-capture-packets-as-an-unprivileged-user](https://www.bro.org/documentation/faq.html#how-can-i-capture-packets-as-an-unprivileged-user) Does tcpdump provide expected output when run against br0? Hope this helps, Jim ---
**Author:** ![Sniper](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@Sniper](https://community.zeek.org/u/Sniper)\ **Post date:** [October 17, 2017, 1:38pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/3 "2017-10-17T13:38:29Z")
Hello Jim, Thanks a lot just what I needed, trying to search for everything just takes up too much time. Running as root is just sudo -s then broclt right or do I need to change it as stated in that link you sent me? No tcpdump does not work against br0 but it runs agains eth0 and eth1. I have assigned a IP address to br0, is this even required? I tried to use OpenBSD to accomplish a network tap but brconfig that configures the bridge is not in the operating system for some reason. I gett an error saying its not recognised, after many hours of searching I couldn’t find a solution. Linux is a pain in the backside, it takes up soo much time trying to find solutions to problems. This is my layout, I have put everything on the same subnet to just to get things started. VM ethernet adapter(my PC) 192.168.10.5 - no gateway Ubuntu (Bro/Bridge) br0 192.168.10.1 - no gateway eth0 192.168.10.2 - no gateway eth1 192.168.10.3 - no gateway Ubuntu Victim 192.168.10.6 - gw 192.168.10.2 Linux Kali Attacker 192.168.10.7 - gw 192.168.10.3 Regards Daniel ---
**Author:** ![Sniper](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@Sniper](https://community.zeek.org/u/Sniper)\ **Post date:** [October 17, 2017, 3:25pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/4 "2017-10-17T15:25:04Z")
Ok so I removed eth0/1 from network connections, the ethernet connection so br0 has br0 slave 1 and 2 which has removed the IP addresses and is now using MAC addresses on eth 0/1. Now when I ping the br0 192.168.10.1 I get activity using tcpdump, however, when I ping hosts Attacker and Victim from eachother there is no activity on br0. Regards Daniel ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [October 17, 2017, 8:37pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/5 "2017-10-17T20:37:55Z")
Assuming that you’re just doing the bonding for monitoring purposes, you could also have bro monitor multiple interfaces, see: [http://mailman.icsi.berkeley.edu/pipermail/bro/2014-January/006477.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2014-January/006477.html) Running bro as root is possible, but could be a security risk - the setcap method is safer & better. Hope this helps, Jim ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/documentation-and-getting-started/5062/6 "2022-05-06T15:45:21Z")