# how can detect attack from pcap by bro

**URL:** <https://community.zeek.org/t/how-can-detect-attack-from-pcap-by-bro/5316>\
**Category:** Zeek\
**Created:** [May 19, 2018, 2:16am UTC](https://community.zeek.org/t/how-can-detect-attack-from-pcap-by-bro/5316 "2018-05-19T02:16:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bz\_Os](https://avatars.discourse-cdn.com/v4/letter/b/5daacb/32.png) [@bz\_Os](https://community.zeek.org/u/bz_Os)\
**Post date:** [May 19, 2018, 2:16am UTC](https://community.zeek.org/t/how-can-detect-attack-from-pcap-by-bro/5316/1 "2018-05-19T02:16:18Z")

</div>

hello evry one i  
I tested bro ids with tcpdump darpa 1999 I imported all the script for the detection,as results i had nodetection all results are about protocol detector ,i tested also suricata with the same tcpdump as results suricata detect large number of attack ,

i want to know how can i use bro for detect attack in the tcp dump to compare the number of attack detected against suricata

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/how-can-detect-attack-from-pcap-by-bro/5316/2 "2022-05-06T15:45:48Z")

</div>

Closed on May 6, 2022, 3:45pm UTC