Running Bro on Mac OS X 10.8.5

Zeek
1

Hello All,

I downloaded Bro ( .dmg, full ) from Bro.org and installed it.

I do not recall having any issue with the install.

I wanted to have Bro read in a pcap file and the resulted in:

/opt/bro/bin/bro -r myidftraffic.pcap
internal error: can’t load magic file : no magic files loaded
Abort trap: 6

How do I correct this error?

Thanks in advance.

Art

2

I downloaded Bro ( .dmg, full ) from Bro.org and installed it.

/opt/bro/bin/bro -r myidftraffic.pcap
internal error: can't load magic file <default>: no magic files loaded
Abort trap: 6

How do I correct this error?

I suggest building from sources instead.

From [1]:

"Mac OS X packages are currently for Mavericks (10.9) only and the Bro packages also require libmagic to be installed — using the version from MacPorts should work, while other versions require setting the MAGIC environment variable to the path of the installed libmagic’s magic database file before running Bro."

- Jon

[1] http://bro.org/download/index.html#binarypackages

3

Or if you prefer, 2.2 is available via MacPorts or Homebrew.

- Jon

4

Thanks Jon.

Since the .dmg are for 10.9, I attempted install Bro on 10.9 and still got same error.

I installed MacPorts, then install libmagic, and then install the Bro Mac package.

It is possible that I am not installing one of these correctly.

To run Bro, I ended up setting the MAGIC environment variable:

export MAGIC=/opt/local/share/misc/magic.mgc

I did this from the terminal, but is there a config file that this can be put into so I don’t have to remember to set MAGIC variable every time use Bro?

Thanks - Art

5

Since the .dmg are for 10.9, I attempted install Bro on 10.9 and still got same error.

Yeah, it’s a problem with Bro's binary OS X packaging, sorry about that.

To run Bro, I ended up setting the MAGIC environment variable:
export MAGIC=/opt/local/share/misc/magic.mgc

I did this from the terminal, but is there a config file that this can be put into so I don't have to remember to set MAGIC variable every time use Bro?

There’s not a Bro-specific config file you can put that in, but you could probably put it in your ~/.profile.

Since you’ve got MacPorts already, you might try to install bro through that instead of use the binary package from bro.org. The MacPorts Bro package shouldn’t require setting any extra environment vars.

- Jon