bro - 启动兄弟时出错

Question

我正在尝试在我运行 Ubuntu 16.04 的机器上安装 Bro，但在 bro 启动时我遇到了以下问题。它有多个错误，请协助解决这些错误。

[BroControl] > start
starting bro (was crashed) ...
bro terminated immediately after starting; check output with "diag"
[BroControl] > diag
[bro]

Bro 2.4.1
Linux 4.4.0-36-generic


==== No reporter.log

==== stderr.log
    fatal error: problem with interface eth0 (eth0: SIOCETHTOOL(ETHTOOL_GET_TS_INFO) ioctl failed: No such device)

==== stdout.log
max memory size         (kbytes, -m) unlimited
data seg size           (kbytes, -d) unlimited
virtual memory          (kbytes, -v) unlimited
core file size          (blocks, -c) unlimited

==== .cmdline
-i eth0 -U .status -p broctl -p broctl-live -p standalone -p local -p bro local.bro broctl broctl/standalone broctl/auto

==== .env_vars
PATH=/usr/bin:/usr/share/broctl/scripts:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
BROPATH=/var/spool/bro/installed-scripts-do-not-touch/site::/var/spool/bro/installed-scripts-do-not-touch/auto:/usr/share/bro:/usr/share/bro/policy:/usr/share/bro/site
CLUSTER_NODE=

==== .status
TERMINATED [atexit]

==== No prof.log

==== No packet_filter.log

==== No loaded_scripts.log

我的 ifconfig 显示了这个:

root@anuvrattiku-Inspiron-13-7368:/etc# ifconfig -a
lo        Link encap:Local Loopback  
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      RX packets:6594 errors:0 dropped:0 overruns:0 frame:0
      TX packets:6594 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1 
      RX bytes:950826 (950.8 KB)  TX bytes:950826 (950.8 KB)

wlp1s0    Link encap:Ethernet  HWaddr 68:07:15:23:f2:f8  
      inet addr:10.250.39.91  Bcast:10.250.255.255  Mask:255.255.0.0
      inet6 addr: fe80::274a:2cde:a0c8:1131/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:271804 errors:0 dropped:0 overruns:0 frame:0
      TX packets:49076 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:342567344 (342.5 MB)  TX bytes:6733501 (6.7 MB)

如有任何帮助，我们将不胜感激。

Answer 1

你需要主要检查 bro 配置文件“/usr/local/bro/etc/node.cfg”并修改主机名和接口(interface)变量

根据诊断结果显示“==== .cmdline-i eth0 -U .status -p broctl "这意味着它正在使用默认配置。因此。让它工作所需要做的只是将界面更改为 wlp1s0

请注意，您需要进行更多配置才能开始使用它。