Building a custom BRO IDS binary package Basically, there are two ways to install BRO. One is, download the source and compile it for your machine. The other option is to install BRO from a package. Compiling from source is a great option, which allows for customization but can become problematic when deploying BRO on several sensors. To address this challenge, compiling BRO on a build machine, and distributing the resulting package to sensor nodes for installation, seems like a good idea.

Installing pf_ring PF_RING is software that installs a network socket allowing for “High-speed packet capture, filtering and analysis” https://www.ntop.org/products/packet-capture/pf_ring/. It is useful in applications where capturing a lot of network traffic is a requirement such as Snort or BRO IPS/IDS deployments. When possible, I use salt to manage pf_ring deployments but manual steps are condensed from the online documentation located at https://www.ntop.org/get-started/download/#PF_RING. For the purpose of this article, we will be installing the stable package on a CentOS 7 system from http://packages.