# Monitoring a directory and running bro on the PCAPs **URL:** \ **Category:** Zeek\ **Created:** [September 23, 2016, 5:26pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361 "2016-09-23T17:26:50Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Art\_Maddalena](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@Art\_Maddalena](https://community.zeek.org/u/Art_Maddalena)\ **Post date:** [September 23, 2016, 5:26pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/1 "2016-09-23T17:26:50Z")
Does anyone have experience using Bro to run its analysis on PCAPs being written to a directory in an automated fashion? Should a cron just be run at a lag using bro -r and script options? Thank you, -Art ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [September 30, 2016, 9:16pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/2 "2016-09-30T21:16:40Z")
Hi Art, that is the easiest way to do that, yes, just run Bro after the pcap files have been written. The only disadvantage of this approach is that you loose session state between runs of Bro; when you run Bro on the following file, it will not parse any data from tcp sessions that started in the previous file. Johanna ---
**Author:** ![Art\_Maddalena](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@Art\_Maddalena](https://community.zeek.org/u/Art_Maddalena)\ **Post date:** [September 30, 2016, 9:19pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/3 "2016-09-30T21:19:15Z")
Thank you. Is it possible to stream the pcap data to bro in lieu of monitoring a directory? Thanks! Art ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [September 30, 2016, 9:25pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/4 "2016-09-30T21:25:21Z")
Hi, unless you have a way to replay the data to an interface that Bro can listen on (either by duplicating the traffic, or by using something like tcpreplay), I am not really aware of a good solution. Johanna ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [September 30, 2016, 9:42pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/5 "2016-09-30T21:42:00Z")
Either that or inotify that's runs bro with a few lines of Python code. Replaying is better because it won't create a backlogs or bros. Or even a few lines in Python with inotify that starts replay? ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [September 30, 2016, 9:50pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/6 "2016-09-30T21:50:01Z")
Hi, I have made a packetbroker for this. Use tcpdump + netcat to the packetbroker for each interface. Then with one bro consume all packets from the broker. [https://hub.docker.com/r/danielguerra/packetbroker/](https://hub.docker.com/r/danielguerra/packetbroker/) Its a concept test and was written in perl. Regards, Daniel ---
**Author:** ![Art\_Maddalena](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@Art\_Maddalena](https://community.zeek.org/u/Art_Maddalena)\ **Post date:** [September 30, 2016, 10:01pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/7 "2016-09-30T22:01:27Z")
Thank you all for the advice. I am trying not to duplicate capturing efforts as we use a different in house developed open sourced tool (Moloch) for capture as well. Currently I am running bro concurrently with suri and would love to reduce the overhead of performing both capture and analysis with bro. Thanks again all! I will think about using our npbs for a duplicate traffic stream and look into the other suggestions mentioned as well. Art ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [October 1, 2016, 3:15am UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/8 "2016-10-01T03:15:22Z")
Hmm, it probably wouldn't be that hard to write a 'pcapdir' pkt source for bro. Basically it would just need to: while(!terminating) {     pcap\_files = all .pcap files in SOURCE\_DIR     sort pcap\_files by oldest # hopefully there is only one file     for each pcap file {         open and process packets into bro         delete pcap #or move to a DONE\_DIR/.     }     if no files in pcap\_files         sleep(10ms) } You'd just need the other tool to hardlink or move the pcaps into the SOURCE\_DIR as they are done being written to. This would also fix the tcp session issues. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/monitoring-a-directory-and-running-bro-on-the-pcaps/4361/9 "2022-05-06T15:44:03Z")