Timemachine and Bro 1.5.1?

Zeek
1

I just downloaded and configured timemachine (http://www.net.t-labs.tu-berlin.de/research/tm/#download) and am attempting to integrate it with Bro 1.5.1. Upon defining my timemachinehost in broctl.conf and restarting Bro it caused my timemachine process to abort with the following error:

*** Broccoli error: bro_conn_new_socket called without prior initialization.

*** Initialization of the Broccoli library is now required.

*** See documentation for details. Aborting.

I noticed the latest download of timemachine is from February of 2009. However Bro 1.5.1 is a lot newer than that. Is anyone running the newest Bro IDS with timemachine? If so what is the workaround or fix for the above error?

Thanks,

Scott Powell

Unix Systems Engineer / Information Security Analyst

Office of the CIO - Information Systems (OCIO-IS)

Medical University of South Carolina

powellsm@musc.edu

(843) 792-6651

2

The Broccoli API changed and Time Machine was not updated for the change.

I suppose this is as good of a time as any to announce the move of the Time Machine project from TU-Berlin to ICSI. The source code repository is now public and there is a ticket tracker. You should be able to find everything at the following URL:
     http://tracker.icir.org/time-machine

The change needed is actually very small and someone may provide a patch, but I'm hoping in the next day or two to get some time (sigh) to do the patch and make a new release of Time Machine available.

I'd also like to say thanks to all involved parties for making it possible to move the Time Machine project to ICSI!

Thanks,
   .Seth

3

See attached, it works for me :slight_smile:

0001-Initialize-broccoli-library.patch (846 Bytes)