1
0
mirror of https://github.com/vimagick/dockerfiles.git synced 2024-12-16 11:37:32 +02:00
dockerfiles/bro/README.md
2015-06-23 09:00:07 +08:00

50 lines
1001 B
Markdown

The Bro Network Security Monitor
================================
[![](https://badge.imagelayers.io/vimagick/bro:latest.svg)](https://imagelayers.io/?images=vimagick/bro:latest 'Get your own badge on imagelayers.io')
`Bro` is a powerful network analysis framework that is much different from the
typical IDS you may know.
- Adaptable
- Efficient
- Flexible
- Forensics
- Commercially Supported
- In-depth Analysis
- Highly Stateful
- Open Interfaces
- Open Source
## docker-compose.yml
```
bro:
image: vimagick/bro
command: bro -i eth0
volumes:
- ./logs:/opt/bro/logs
net: container:shadowsocks_shadowsocks_1
```
> We are going to monitor `shadowsocks` which is a socks5 server.
## up and running
```
$ cd ~/fig/bro/
$ docker-compose up -d
$ docker exec -it bro_bro_1 bash
>>> cat dns.log | bro-cut query | sort | uniq -c | sort -nr | head -5
10 www.youtube.com
3 twitter.com
2 www.google.com
1 www.baidu.com
1 www.facebook.com
>>> exit
```
> Don't be evil!