Current behavior

Currently, there are a few bugs involving interface selection when installing Bro. The issues currently include:

• When selecting interfaces for Bro, AI-Hunter will not receive any data if only the bridge (br-...) interface is selected.
• When selecting interfaces for Bro, the installer will fail if the user selects the virtual (v...) interfaces.

Desired behavior

The installer should not fail when selecting bro interfaces. The available interface list should be changed to reflect this, or the user should at least be notified of this situation when selecting interfaces.

A prompt will be adjusted in the installer to provide users with more information regarding this issue.

That script is the only remaining thing updated/maintained in this repo.

Move it to its own repo and consider archiving this repo.

Make gen-node-cfg.sh use zeek paths if they exist.
Change bro in comments of node.cfg-template to zeek.

I saw a recommendation in the Bro mailing list to leave 4 processors free when assigning workers. 2 for the kernel, 1 for the manager, and 1 for the proxy. They claimed this recommendation came from a research paper on Suricata performance and that it applied to Bro as well. I haven't been able to track down the research paper yet.

This line should be changed to account for this.
https://github.com/activecm/bro-install/blob/master/gen-node-cfg.sh#L192

This was on a user's network so I may have trouble reproducing. But even with the latest updates, bro's ./configure line would not link with the libpcap.so.1 library located in /usr/local/pfring/lib. It did not work when the user ran the script themselves and I tried troubleshooting and could not get it working manually either.

If a user runs the gen-node-cfg.sh and they have not brought their monitor interface up, it will not be available for selection.

It appears the the setup.sh script is hanging on the aux/binpac submodule during the script installation.

remote: Counting objects: 99511, done.
remote: Compressing objects: 100% (124/124), done.
remote: Total 99511 (delta 88), reused 123 (delta 57), pack-reused 99314
Receiving objects: 100% (99511/99511), 64.28 MiB | 8.76 MiB/s, done.
Resolving deltas: 100% (69207/69207), done.
Checking connectivity... done.
Note: checking out '697aff2c0d569a8db1ca6b990a10838665a002c8'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b <new-branch-name>

Submodule 'aux/binpac' (git://git.bro.org/binpac) registered for path 'aux/binpac'
Submodule 'aux/bro-aux' (git://git.bro.org/bro-aux) registered for path 'aux/bro-aux'
Submodule 'aux/broccoli' (git://git.bro.org/broccoli) registered for path 'aux/broccoli'
Submodule 'aux/broctl' (git://git.bro.org/broctl) registered for path 'aux/broctl'
Submodule 'aux/broker' (git://git.bro.org/broker) registered for path 'aux/broker'
Submodule 'aux/btest' (git://git.bro.org/btest) registered for path 'aux/btest'
Submodule 'aux/netcontrol-connectors' (git://git.bro.org/bro-netcontrol) registered for path 'aux/netcontrol-connectors'
Submodule 'aux/plugins' (git://git.bro.org/bro-plugins) registered for path 'aux/plugins'
Submodule 'cmake' (git://git.bro.org/cmake) registered for path 'cmake'
Submodule 'src/3rdparty' (git://git.bro.org/bro-3rdparty) registered for path 'src/3rdparty'
Cloning into 'aux/binpac'...```

While everything compiles just fine as is, CAF lists google protobuf as an optional dependency. Other programs which rely on CAF may need this optional dependency. To resolve it, use apt install libprotobuf-dev protobuf-compiler