# Off-line analysis

**URL:** <https://community.zeek.org/t/off-line-analysis/642>\
**Category:** Zeek\
**Created:** [December 5, 2004, 9:22pm UTC](https://community.zeek.org/t/off-line-analysis/642 "2004-12-05T21:22:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shonx001](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@shonx001](https://community.zeek.org/u/shonx001)\
**Post date:** [December 5, 2004, 9:22pm UTC](https://community.zeek.org/t/off-line-analysis/642/1 "2004-12-05T21:22:12Z")

</div>

When I try to off-line analysis with -r option, how can I use all Bro  
rules?  
I just found some example about off-line, but it seems that I can apply 1  
time 1 rule.  
Could you let me know how all bro rules can be applied to specific tcp  
rawfile?

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# set up the Bro environment (sh or bash)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;. /usr/local/bro/etc/bro.cfg  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/usr/local/bro/bin/bro -r dumpfile backdoor.bro

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/off-line-analysis/642/2 "2022-05-06T15:37:16Z")

</div>