Bro detects traffic on non-standard ports. Unlike other tools, it has notion of inbound and outbound traffic once you tell it the address space of your network:
bro -r trace.pcap local "Site::local_nets += { 1.2.3.0/24, 5.6.7.0/24 }"
See the quickstart guide for details on how to get started. Running Bro with the default arguments, i.e.,
bro -i <interface>
creates already a variety of log files in the current directory. The connection log (conn.log
), contains for example entries along the lines of:
# ts uid orig_h orig_p resp_h resp_p
1311627961.8 HSH4uV8KVJg 192.168.1.100 52303 192.150.187.43 80
These are only a subset of the available columns. The log files are designed so that you can easily process them with awk
and friends. E.g., to see the connection breakdown by service:
bro-cut service < conn.log | sort | uniq -c
This and other quick analyses will quickly tell you what's going on in your network.