# Off-line analysis

**URL:** <https://community.zeek.org/t/off-line-analysis/643>\
**Category:** Zeek\
**Created:** [December 5, 2004, 9:38pm UTC](https://community.zeek.org/t/off-line-analysis/643 "2004-12-05T21:38:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [December 5, 2004, 9:38pm UTC](https://community.zeek.org/t/off-line-analysis/643/1 "2004-12-05T21:38:14Z")

</div>

> When I try to off-line analysis with -r option, how can I use all Bro  
> rules?

The notion of "all Bro rules" is not that well defined. There are a large  
number (100+) of policy files in policy/\*.bro, some of which are incompatible  
with others (for example, print-filter.bro prints the BPF filter being used  
and then exits).

That said, here's what we use when to run against our internal test suite:

&nbsp;&nbsp;@load site  
&nbsp;&nbsp;@load mt  
&nbsp;&nbsp;@load tftp  
&nbsp;&nbsp;@load dns  
&nbsp;&nbsp;@load flag-irc  
&nbsp;&nbsp;@load smtp-relay  
&nbsp;&nbsp;@load software  
&nbsp;&nbsp;@load ssh  
&nbsp;&nbsp;@load worm  
&nbsp;&nbsp;@load backdoor.bro  
&nbsp;&nbsp;@load blaster.bro  
&nbsp;&nbsp;@load flag-warez.bro  
&nbsp;&nbsp;@load gnutella.bro  
&nbsp;&nbsp;@load http-abstract.bro  
&nbsp;&nbsp;@load http-body.bro  
&nbsp;&nbsp;@load http-reply.bro  
&nbsp;&nbsp;@load icmp.bro  
&nbsp;&nbsp;@load ssl-worm.bro  
&nbsp;&nbsp;@load stepping.bro  
&nbsp;&nbsp;@load synflood.bro

This winds up loading a whole lot of the analysis.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![john\_mcnicholas](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@john\_mcnicholas](https://community.zeek.org/u/john_mcnicholas)\
**Post date:** [December 5, 2004, 10:25pm UTC](https://community.zeek.org/t/off-line-analysis/643/2 "2004-12-05T22:25:14Z")

</div>

> When I try to off-line analysis with -r option, how can I use all Bro  
> rules?

I'm taking at stab at this since I've been wrestling with a very similar  
situation for a class. Anyway, if by rules you mean snort type signatures  
you can do one of the following:

a. on the command line via -s rulefilename

b. in a policy script using the "signature\_files" variable. i'm been doing  
the following:

&nbsp;&nbsp;redef signature\_files += "snort-default.sig";  
&nbsp;&nbsp;redef signature\_files += "worm.sig";

In addition I threw in an event to dump some info out.

event bro\_init()  
{  
&nbsp;&nbsp;print fmt("-- signature\_files = [%s]", signature\_files);

&nbsp;&nbsp;# the http\_servers is readable but by no means pretty.  
&nbsp;&nbsp;print fmt("-- http\_servers = [%s]", http\_servers);  
}

Note: I'm no expert but I believe http\_servers is signficant for a number of  
the snort signatures.

For what its worth, I've been attempting to compare snort vs bro for a class  
(perhaps like you are) and evidently I'm doing something wrong since I get  
dozens of unique alerts (or alarms) in snort, but only 3 unique ones in bro.  
I'm sure it is a configuration problem but if anyone wants to volunteer any  
suggestions it would be appreciated.

thanks.

john

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/off-line-analysis/643/3 "2022-05-06T15:37:16Z")

</div>