# Off-line analysis

**URL:** <https://community.zeek.org/t/off-line-analysis/646>\
**Category:** Zeek\
**Created:** [December 5, 2004, 11:39pm UTC](https://community.zeek.org/t/off-line-analysis/646 "2004-12-05T23:39:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shonx001](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@shonx001](https://community.zeek.org/u/shonx001)\
**Post date:** [December 5, 2004, 11:39pm UTC](https://community.zeek.org/t/off-line-analysis/646/1 "2004-12-05T23:39:26Z")

</div>

Thanks for your kind explanation.  
Anyhow, what I really want to know is to do some ID attack ananlsys using  
Bro.  
If you have experienced such things with Bro, please let me know.  
I get some tcpdump raw file, but it is not easy to handle Bro for offline  
test.

> \> When I try to off-line analysis with -r option, how can I use all Bro  
> \> rules?
> 
> I'm taking at stab at this since I've been wrestling with a very similar  
> situation for a class. Anyway, if by rules you mean snort type

signatures

> you can do one of the following:
> 
> a. on the command line via -s rulefilename
> 
> b. in a policy script using the "signature\_files" variable. i'm been

doing

> the following:
> 
> &nbsp;&nbsp;redef signature\_files += "snort-default.sig";  
> &nbsp;&nbsp;redef signature\_files += "worm.sig";
> 
> In addition I threw in an event to dump some info out.
> 
> event bro\_init()  
> {  
> &nbsp;&nbsp;print fmt("-- signature\_files = [%s]", signature\_files);
> 
> &nbsp;&nbsp;# the http\_servers is readable but by no means pretty.  
> &nbsp;&nbsp;print fmt("-- http\_servers = [%s]", http\_servers);  
> }
> 
> Note: I'm no expert but I believe http\_servers is signficant for a number

of

> the snort signatures.
> 
> For what its worth, I've been attempting to compare snort vs bro for a

class

> (perhaps like you are) and evidently I'm doing something wrong since I

get

> dozens of unique alerts (or alarms) in snort, but only 3 unique ones in

bro.

> I'm sure it is a configuration problem but if anyone wants to volunteer

any

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/off-line-analysis/646/2 "2022-05-06T15:37:16Z")

</div>