# Error Bro install **URL:** \ **Category:** Zeek\ **Created:** [June 13, 2005, 6:37pm UTC](https://community.zeek.org/t/error-bro-install/770 "2005-06-13T18:37:42Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [June 13, 2005, 6:37pm UTC](https://community.zeek.org/t/error-bro-install/770/1 "2005-06-13T18:37:42Z")
> Now I downloaded the the current release 0.9 and the installation completed. > Does it version is good to use ? Yes, I believe the CURRENT release is fairly stable at this point.     Vern ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [June 15, 2005, 2:39pm UTC](https://community.zeek.org/t/error-bro-install/770/2 "2005-06-15T14:39:12Z")
Hi! I tried to test the tcpdump -w, following the steps bellow: Bro can also be run on tcpdump -w files instead of on live traffic. To do this, you must set a BROPATH enviroment variable to point at your set of policy scripts. For example: ```auto setenv BROHOME /usr/local/bro setenv BROPATH $BROHOME/policy:$BROHOME/site bro -r dumpfile brohost ``` I used those commands: BROHOME=/usr/local/bro BROPATH=/usr/local/bro/policy:/usr/local/bro/site When I tried this command: “bro -r /home/xxxx/tcpdump.teste scan” , I received this message: **line 1: error: can’t open bro.init** What can I do to resolve this problem? Thanks, Angelita ---
**Author:** ![Holger\_Dreger](https://avatars.discourse-cdn.com/v4/letter/h/a5b964/32.png) [@Holger\_Dreger](https://community.zeek.org/u/Holger_Dreger)\ **Post date:** [June 15, 2005, 7:46pm UTC](https://community.zeek.org/t/error-bro-install/770/3 "2005-06-15T19:46:00Z")
This error usually indicates that the $BROPATH variable does not point to the policy directory (where, among others, the file bro.init is located). Hope this helps,   Holger Holger Dreger \*\* [http://www.net.in.tum.de](http://www.net.in.tum.de) \*\* Tel.: +49 (0)89 289-18006 Lehrstuhl fuer Netzwerkarchitekturen, Technische Universitaet Muenchen ---
**Author:** ![Holger\_Dreger](https://avatars.discourse-cdn.com/v4/letter/h/a5b964/32.png) [@Holger\_Dreger](https://community.zeek.org/u/Holger_Dreger)\ **Post date:** [June 16, 2005, 2:27pm UTC](https://community.zeek.org/t/error-bro-install/770/4 "2005-06-16T14:27:21Z")
Hi, > I used those commands: > > BROHOME=/usr/local/bro > BROPATH=/usr/local/bro/policy:/usr/local/bro/site sorry, I overlooked one detail: You have to export the BROPATH variable in order to make bro work. You only set the variable for the shell itself, not for its executed commands. So in sh or bash use: export BROHOME=/usr/local/bro export BROPATH=/usr/local/bro/policy:/usr/local/bro/site Holger ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [June 16, 2005, 2:35pm UTC](https://community.zeek.org/t/error-bro-install/770/5 "2005-06-16T14:35:28Z")
Thanks, I put the two lines in .bash\_profile: export BROHOME=/usr/local/bro export BROPATH=/usr/local/bro/policy:/usr/local/bro/site Now, when I run this command to test: /usr/local/bro/bin/bro -r /home/angelita/test.trace scan I received this message: /usr/local/bro/bin/bro: problem with trace file /home/angelita/test.trace - fread: Inappropriate ioctl for device I have a question, what kind of file I have to create to be a tracefile? Do I have to follow some tips? Thanks Angelita ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [June 16, 2005, 6:15pm UTC](https://community.zeek.org/t/error-bro-install/770/6 "2005-06-16T18:15:26Z")
I believe that's a pcap error message passed to Bro, and I seem to recall seeing that error message when the trace file you're passing is empty. Could that be possible? In any case, you want that file to be a pcap trace file, typically generated using tcpdump -w.   [http://mailman.icsi.berkeley.edu/pipermail/bro/2004-July/001545.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2004-July/001545.html) Cheers, Christian. ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [June 16, 2005, 7:40pm UTC](https://community.zeek.org/t/error-bro-install/770/7 "2005-06-16T19:40:10Z")
Now, I tested using this commands: > /usr/local/bro/bin/bro -r /home/angelita/test.trace tcp.bro line 1: warning: event handlers never invoked: line 1: warning: account\_tried Saving state... > /usr/local/bro/bin/bro -r /home/angelita/test.trace scan.bro Reading .state/state.bst ... line 1: warning: event handlers never invoked: line 1: warning: account\_tried Saving state... In the logs directory /usr/local/bro/logs, I have logs about my scan tests, but if I run the site-report.pl and mail\_reports.sh scripts, they don't show the scans, for example. What the best form to resolve this ? Now the report shows the IP ("attack machine") , but doesn't show the scans ou incidents details. Thanks ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [June 16, 2005, 7:46pm UTC](https://community.zeek.org/t/error-bro-install/770/8 "2005-06-16T19:46:42Z")
I test the tcpdump -w only to test, but I will run Bro on a live traffic. Do I need to edit some policies files, like scan.bro, tcp.bro or others files? Thanks ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [June 16, 2005, 9:02pm UTC](https://community.zeek.org/t/error-bro-install/770/9 "2005-06-16T21:02:05Z")
No, it doesn't matter to the policy scripts whether the traffic comes from trace files or a live network. The only difference is in the way you start Bro (-i vs -r). Cheers, Christian. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/error-bro-install/770/10 "2022-05-06T15:37:30Z")
Closed on May 6, 2022, 3:37pm UTC