# Query reagrding Bro Ids **URL:** \ **Category:** Zeek\ **Created:** [July 12, 2019, 4:51am UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762 "2019-07-12T04:51:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Manoj\_Petshali](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Manoj\_Petshali](https://community.zeek.org/u/Manoj_Petshali)\ **Post date:** [July 12, 2019, 4:51am UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/1 "2019-07-12T04:51:19Z")
Hi Team, I am very eager about the Bro and need to know below information : -We are working in india’s biggest transactional system and facing many issues e.g. : if some user request is coming from pubic or private network (Internal request) and traverses across many servers and if user receives timeout ( e.g. connection time out, read time out ,rst etc) then we need to know the deep analysis of the same means : : Why/where the request timed out ? : Upto which hop the request travelled? : Network latency between these hopes to know if the latency is the issue? : tcp handshake and ssl handshake latency and the reason for the same? : Applicatency latency ? means if the network latency is fine We searched on wen and got feeling that the Bro is more oriented toward security and do deep packe inspection.But we have many problems like above to resolve .May you please let us know that how Bro can help us to resolve above issues? ![noname.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/1ab191d22d1892958133a4f15d8a52ea0b63cf9c.png) ---
**Author:** ![Manoj\_Petshali](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Manoj\_Petshali](https://community.zeek.org/u/Manoj_Petshali)\ **Post date:** [July 12, 2019, 8:24am UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/2 "2019-07-12T08:24:43Z")
Hi Team, Please respond as we need to implement the same at the earliest. ![noname.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/1ab191d22d1892958133a4f15d8a52ea0b63cf9c.png) ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [July 12, 2019, 8:17pm UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/3 "2019-07-12T20:17:25Z")
Hi Manoj: The issue you described seems more on the networking side, rather than the IDS side. However, it seems likely that a much bigger issue that a business like yours would face would be that of cybersecurity, in particular, securing your servers from unauthorized intrusion and data exfiltration. In this, Zeek (the opensource IDS formerly known as Bro) can play an important role in early detection of possible intrusions. Hope this helps, Jim ---
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [July 12, 2019, 8:34pm UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/4 "2019-07-12T20:34:41Z")
Hello Manoj, you can sure use zeek to get more visibility into your traffic and connections. It has a pretty good and powerful tcp analysis engine built into. I am sure zeek can get you a lot of diagnostic data - I say that from our experience at Berkeley Lab where we do a lot of proactive blocking and always rely on zeek's conn.log (and similar) to look into connectivity issues. So to me what you seek, is not too difficult. The difficult part for you is going to be getting this traffic into zeek or putting taps/sensors at the right places. Do you have taps on the points you want to monitor ? Aashish ---
**Author:** ![Manoj\_Petshali](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Manoj\_Petshali](https://community.zeek.org/u/Manoj_Petshali)\ **Post date:** [July 13, 2019, 8:07am UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/5 "2019-07-13T08:07:04Z")
Hi Ashish, Thanks a lot for your response. we do not have taps/sensors as of now. if we have taps placed at right places , may you elaborate what kind of difficulty we may face? Also let me know if we can filter and send the traffic (without payload) according to our requirement e.g. flags only like syn, synack,ack, timeout etc to zeek for troubleshooting. May you please share some data/charts depicting the information we are looking for (as per the trail mail ) so that we may proceed further. ![noname.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/1ab191d22d1892958133a4f15d8a52ea0b63cf9c.png) ---
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [July 17, 2019, 8:02pm UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/6 "2019-07-17T20:02:18Z")
Manoj, (Apologies for the delayed reply!) > we do not have taps/sensors as of now. if we have taps placed at right > places , may you elaborate what kind of difficulty we may face? That is generally the most difficult part - to put the taps in right places to be able to sniff the bytes - gain visibility. YOu might have issues with encryption - in which case you'd still see connection info but not the contents. I know some sites have workaround where the taps are 'beyond encryption' - ie you might want to tap behind load balancers where SSL terminates etc. If you are able to do that, you should be able to get zeek running and seeing the traffic and also reporting tcp flags/states etc. > Also let me know if we can filter and send the traffic (without payload) > according to our requirement e.g. flags only like syn, synack,ack, timeout > etc to zeek for troubleshooting. Yes, you can do that - as long as control packets are sent, zeek is able to handle most, if not all, of connection info. We at Berkeley Lab do this for one of our deployment. > May you please share some data/charts depicting the information we are > looking for (as per the trail mail ) so that we may proceed further. I am afraid I don't have data/charts for information you are looking for handy with me. I'd advice you should run zeek on a laptop/linux box - feed it some data and see if you are seeing what you desire. If so, you can scale up to your needs. roughly 4 years ago we did write a document which shows how you'd deploy zeek: go.lbl.gov/100g - may be useful. But as far as what you seek, you should look at conn.log and try to understand it: read this page -- has pretty detailed info on connection record: [https://docs.zeek.org/en/stable/scripts/base/protocols/conn/main.bro.html](https://docs.zeek.org/en/stable/scripts/base/protocols/conn/main.bro.html) Hope this helps. Aashish ---
**Author:** ![Manoj\_Petshali](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@Manoj\_Petshali](https://community.zeek.org/u/Manoj_Petshali)\ **Post date:** [July 18, 2019, 4:15am UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/7 "2019-07-18T04:15:31Z")
Hi Aashish, Thanks for knowledge sharing. We will check the docs and will contact you as and when required. ![noname.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/1ab191d22d1892958133a4f15d8a52ea0b63cf9c.png) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/query-reagrding-bro-ids/5762/8 "2022-05-06T15:46:37Z")