​Bro est un NIDS qui permet d'analyser le trafic réseau de façon sensiblement différente de Snort ou Suricata. 

Bro provides a comprehensive pl​atform for network traffic analysis, with a particular focus on semantic security monitoring at scale. While often compared to classic intrusion detection/prevention systems, Bro takes a quite different approach by providing users with a flexible framework that facilitates customized, in-depth monitoring far beyond the capabilities of traditional systems. With initial versions in operational deployment during the mid ‘90s already, Bro finds itself grounded in more than 15 years of research. For more information, see the Bro Overview.

Il analyse de façon protocolaire le trafic et génère plusieurs fichiers de logs contenant des metadata sur le trafic (hôtes contactés, requêtes HTTP, requêtes DNS, certificats x.509, sessions SMTP, etc.)

Bro is a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Bro supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.

L'équipe de Bro a mis en ligne cette semaine un site web qui permet de tester Bro en ligne.

Le site dispose d'un jeu de règles et pcap permettant de voir le fonctionnement de l'outil, mais on peut également ajouter nos propres règles et pcap. L'outil permet aussi de partager ses règles et pcap.

Pour le tester → ​ Try.Bro

Original post of Quack1.Votez pour ce billet sur Planet Libre.