# remote.bro **URL:** \ **Category:** Zeek\ **Created:** [September 28, 2006, 6:57pm UTC](https://community.zeek.org/t/remote-bro/1027 "2006-09-28T18:57:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sandro\_Reichert](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sandro\_Reichert](https://community.zeek.org/u/Sandro_Reichert)\ **Post date:** [September 28, 2006, 6:57pm UTC](https://community.zeek.org/t/remote-bro/1027/1 "2006-09-28T18:57:55Z")
Hi everybody! Where can I find a documentation about inter-bro communication? I can't find anything in the archive or the manuals. I'm using bro 0.9a9, because there is a wireless edition developed at Dresden University of Technology in Germany. I need the inter-bro communication to develop distributed policies. Thanks for all hints! Sandro ---
**Author:** ![Sandro\_Reichert](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sandro\_Reichert](https://community.zeek.org/u/Sandro_Reichert)\ **Post date:** [October 6, 2006, 6:00pm UTC](https://community.zeek.org/t/remote-bro/1027/2 "2006-10-06T18:00:07Z")
thanks for the hints, inter-bro(1.1) communication works 🙂 but - it only works with traffic on the listening interface - is that right? i dont have a network trap or something like this, my configuration for testing is: 2 PCs with 1 eth interface connected to a switch. when i start both bros, there is nothing written into the remote-logs until i start a port-scan to generate traffic. what would be the best way to generate dummy traffic ? Thanks, Sandro ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [October 6, 2006, 7:09pm UTC](https://community.zeek.org/t/remote-bro/1027/3 "2006-10-06T19:09:40Z")
Hi Sandro, > thanks for the hints, inter-bro(1.1) communication works 🙂 great! 🙂 > but - it only works with traffic on the listening interface - is that > right? i dont have a network trap or something like this, my > configuration for testing is: > 2 PCs with 1 eth interface connected to a switch. > when i start both bros, there is nothing written into the remote-logs > until i start a port-scan to generate traffic. what would be the best > way to generate dummy traffic ? Mhmmm this is not supposed to happen any more -- older versions did indeed have the problem that communication was "driven" by observing live traffic, but as of 1.1 this should be fixed. Things depend on whether your OS supports selectable file descriptors or not. Could you please tell us what OS you are on, and post (or send me) the config.h file you obtain after running configure? Thanks. Cheers, Christian. ---
**Author:** ![Sandro\_Reichert](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sandro\_Reichert](https://community.zeek.org/u/Sandro_Reichert)\ **Post date:** [October 7, 2006, 5:21pm UTC](https://community.zeek.org/t/remote-bro/1027/4 "2006-10-07T17:21:00Z")
Hi Christian, \>\> but - it only works with traffic on the listening interface - is that \>\> right? i dont have a network trap or something like this, my \>\> configuration for testing is: \>\> 2 PCs with 1 eth interface connected to a switch. \>\> when i start both bros, there is nothing written into the remote-logs \>\> until i start a port-scan to generate traffic. what would be the best \>\> way to generate dummy traffic ? \> \> Mhmmm this is not supposed to happen any more -- older versions did \> indeed have the problem that communication was "driven" by observing \> live traffic, but as of 1.1 this should be fixed. Things depend on \> whether your OS supports selectable file descriptors or not. Could you \> please tell us what OS you are on, and post (or send me) the config.h \> file you obtain after running configure? Thanks. Im using Suse 10.0 on both machines. One Bro1.1 runs on PC 'A', the other on PC 'B' runs on VMware Server, because I started testing with our wireless 0.9a9 edition and we havnt finished the wireless patch for 1.1 yet. It should be done within the next days. B: Suse 10.0 & "Bro-wireless" 0.9a9     VMware: Suse 10.0 Bro 1.1 The config.h are equal on both machines. bye, Sandro [config.h](https://community.zeek.org/uploads/short-url/w3mJKLXbB6kht2jfN8c7GmU33l7.h) (6.69 KB) ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [October 8, 2006, 4:33am UTC](https://community.zeek.org/t/remote-bro/1027/5 "2006-10-08T04:33:20Z")
Hi Sandro, > Hi Christian, > > Im using Suse 10.0 on both machines. One Bro1.1 runs on PC 'A', the > other on PC 'B' runs on VMware Server, because I started testing with > our wireless 0.9a9 edition and we havnt finished the wireless patch > for > 1.1 yet. It should be done within the next days. > > A: Suse 10.0 & Bro 1.1 > B: Suse 10.0 & "Bro-wireless" 0.9a9 >     VMware: Suse 10.0 Bro 1.1 so you have three Bro nodes? My guess is that the 0.9 one is causing the problem you're seeing. > The config.h are equal on both machines. Mhmmm are you sure about this? My guess is that on the 0.9 setup you need to add --enable-selectloop to the configure invocation. This ensures that events arriving from a remote Bro are treated with the same priority as observed packets. You can check whether that is the case by verifying that USE\_SELECT\_LOOP is defined in config.h after running configure. If the two config.h files really are identical, I don't know what the problem might be... Let us know how it goes. Cheers, Christian. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/remote-bro/1027/6 "2022-05-06T15:37:59Z")