# Offline/Tracefile Traffic Classification with Bro **URL:** \ **Category:** Zeek\ **Created:** [October 21, 2008, 9:33pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417 "2008-10-21T21:33:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Isara\_Anantavrasilp](https://avatars.discourse-cdn.com/v4/letter/i/96bed5/32.png) [@Isara\_Anantavrasilp](https://community.zeek.org/u/Isara_Anantavrasilp)\ **Post date:** [October 21, 2008, 9:33pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/1 "2008-10-21T21:33:38Z")
Hi, I am completely new to Bro and have a few \*naive\* questions. I have already tried to find the answer myself but to no avail. I have to classify and isolate Internet traffics (or Internet flows) which are stored in several trace files which are stored in compressed pcap format. For instance, given a trace file A, and a specific protocol, say, SSH, what I have to do is generate another trace file which contains only SSH packets from the trace A. I do not need the SSH trace file automatically. But I need at least the 5-tuple of the SSH flows that reside in the trace A so that I can extract the SSH packets later. As far as I understand from Bro wiki, Bro can recognize flows from the tcpdump traces which is the same as pcap trace. (Here is where I found it: [http://www.bro-ids.org/wiki/index.php/User\_Manual:\_Bulk\_Traces\_and\_Off-line\_Analysis](http://www.bro-ids.org/wiki/index.php/User_Manual:_Bulk_Traces_and_Off-line_Analysis)) Here are the questions: 1) Can I somehow obtain the flows or packets in the flows that match some certain Bro rules and isolate them? 2) If so, how to do it? I have looked through online documents but cannot get a concrete answer. 3) If not, can I at least identify which flows that match the rules? 4) Is there any rules-repository for Bro (like Snort rules)? Thank you very much. 🙂 Cheers, Isara Anantavrasilp ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 22, 2008, 9:41pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/2 "2008-10-22T21:41:11Z")
Is this what you're looking for? zcat A | tcpdump -r - -w - port 22 | bro -r - tcp; cat conn.log Or if you need just the packets, skip Bro alltogether. Robin ---
**Author:** ![Isara\_Anantavrasilp](https://avatars.discourse-cdn.com/v4/letter/i/96bed5/32.png) [@Isara\_Anantavrasilp](https://community.zeek.org/u/Isara_Anantavrasilp)\ **Post date:** [October 22, 2008, 10:07pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/3 "2008-10-22T22:07:23Z")
Hi, thanks a lot for the answer. That is what I am looking for, but not entirely. As far as I understand from the syntax, it pushes every packet that has TCP port 22 into Bro. Bro then summarizes the connections in the conn.log (using tcp policy). And you are right, I want just the packets so that I can process later. However, it might work with SSH, but the reason I need Bro here is that some applications that I am interested in require payload signatures. And even though it is SSH, I would like to be sure that it is actually SSH (by analyzing the payload not just port number). I just found out that with switch "-w \", Bro can output the packets. If I use sth like bro -r inputtrace.pcap -w outputtrace.pcap somesignature.bro, would Bro return packets of all flows that match the policy in somesignature.bro? Another question, can Bro handle the compressed trace file by itself or I always have to use zcat? Thank you very much! -- Isara ---
**Author:** ![Isara\_Anantavrasilp](https://avatars.discourse-cdn.com/v4/letter/i/96bed5/32.png) [@Isara\_Anantavrasilp](https://community.zeek.org/u/Isara_Anantavrasilp)\ **Post date:** [October 30, 2008, 5:10pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/4 "2008-10-30T17:10:48Z")
Hi Thanks for the advice and sorry for the late reply. I have looked into wireshark even before Bro. The problem that I have is that I have to classify the flows in several extra-large traces. And it cannot be done without some automated tools. Up to now I have written a simple classifier based on libtrace but I am not sure if my own signatures (as well as the algorithm) are valid. And since Bro is designed to do the classification and it already has signatures available. I am hoping that with Bro mechanism, I can classify packets/flows easier with higher accuracy. -- Isara ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 3, 2008, 6:33pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/5 "2008-11-03T18:33:18Z")
> I am hoping that with Bro mechanism, I can classify packets/flows > easier with higher accuracy. Bro cannot directly classify the connections \*and\* extract all of their packets. You could use Bro to classify them first, and then use some other tool to extract all relevant connections. Perhaps NetDude might come in handy as well, see [Netdude](http://netdude.sourceforge.net/plugins-libnetdude.html#appdemux) and perhaps [Netdude](http://netdude.sourceforge.net/plugins-libnetdude.html#demux) I'm sure one could also write a NetDude plugins which takes a list of connections and then writes all packets belonging to one of them into the output file. > > Another question, can Bro handle the compressed trace file by itself > > or I always have to use zcat? You need to use zcat but that's usually not a problem. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/offline-tracefile-traffic-classification-with-bro/1417/6 "2022-05-06T15:38:43Z")