(DEPRECATED) Bro Client Communications Library
Clone or download
Latest commit d583984 Jan 16, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
bindings Updating submodule(s). Jan 16, 2019
cmake @ 6135c1a Updating submodule(s). Jan 16, 2019
compat/sys Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010
contrib Updates to make broccoli work with communication API updates. Oct 7, 2011
doc Fix some typos in the broccoli user manual Mar 21, 2016
src Increasing data format version for Bro change. Jun 15, 2016
test Merge remote-tracking branch 'origin/topic/dnthayer/ticket1821' Jun 14, 2017
.gitignore Cleanup of old files. Nov 27, 2010
.gitmodules Update submodules to use github.com/zeek Dec 6, 2018
.update-changes.cfg Distribution cleanup. Oct 18, 2011
AUTHORS Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010
CHANGES Update github/download link Dec 7, 2018
CMakeLists.txt Removed hostname and date from line 25 of CMakeLists.txt to make pack… Nov 13, 2017
COPYING Updating copyright notice. Oct 8, 2013
Makefile Improve `make dist` Aug 31, 2018
README Update github/download link Dec 7, 2018
README.rst Add README.rst -> README symlink. Jan 11, 2016
TODO Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010
VERSION Update github/download link Dec 7, 2018
broccoli-config.in Merge branch 'master' of https://github.com/dcode/broccoli Sep 30, 2013
broccoli.conf Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010
broccoli.spec Updated specfile and configure script for libdir Sep 28, 2013
btest Updating submodule(s). Jul 5, 2012
config-file.h.in Rebuild only necessary files for new prefix Dec 12, 2012
config.h.in Rebuild only necessary files for new prefix Dec 12, 2012
configure Update for new cmake openssl script Mar 4, 2016
setup.py Updating submodule(s). Jul 5, 2012
svn.pl Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010
ylwrap Import of Bro's aux/broccoli subdir from SVN r7107 Nov 2, 2010


Broccoli: The Bro Client Communications Library

.. rst-class:: opening

  Broccoli is the "Bro client communications library". It allows you
  to create client sensors for the Bro intrusion detection system.
  Broccoli can speak a good subset of the Bro communication protocol,
  in particular, it can receive Bro IDs, send and receive Bro events,
  and send and receive event requests to/from peering Bros. You can
  currently create and receive values of pure types like integers,
  counters, timestamps, IP addresses, port numbers, booleans, and


You can find the latest Broccoli release for download at https://www.zeek.org/download.

Broccoli's git repository is located at https://github.com/zeek/broccoli

This document describes Broccoli 1.101-2. See the CHANGES file for version history.


The Broccoli library has been tested on Linux, the BSDs, and Solaris. A Windows build has not currently been tried but is part of our future plans. If you succeed in building Broccoli on other platforms, let us know!


Broccoli relies on the following libraries and tools, which need to be installed before you begin:

Flex (Fast Lexical Analyzer)
Flex is already installed on most systems, so with luck you can skip having to install it yourself.
Bison (GNU Parser Generator)
This comes with many systems, but if you get errors compiling parse.y, you will need to install it.
OpenSSL headers and libraries
For encrypted communication. These are likely installed, though some platforms may require installation of a 'devel' package for the headers.
CMake 2.6.3 or greater
CMake is a cross-platform, open-source build system, typically not installed by default. See http://www.cmake.org for more information regarding CMake and the installation steps below for how to use it to build this distribution. CMake generates native Makefiles that depend on GNU Make by default.

Broccoli can also make use of some optional libraries if they are found at installation time:

Libpcap headers and libraries
Network traffic capture library


To build and install into /usr/local:

make install

This will perform an out-of-source build into the build directory using the default build options and then install libraries into /usr/local/lib.

You can specify a different installation directory with:

./configure --prefix=<dir>

Or control the python bindings install destination more precisely with:

./configure --python-install-dir=<dir>

Run ./configure --help for more options.

Further notable configure options:

This one enables lots of debugging output. Be sure to disable this when using the library in a production environment! The output could easily end up in undersired places when the stdout of the program you've instrumented is used in other ways.
Broccoli can read key/value pairs from a config file. By default it is located in the etc directory of the installation root (exception: when using --prefix=/usr, /etc is used instead of /usr/etc). The default config file name is broccoli.conf. Using --with-configfile, you can override the location and name of the config file.

To use the library in other programs & configure scripts, use the broccoli-config script. It gives you the necessary configuration flags and linker flags for your system, see --cflags and --libs.

The API is contained in broccoli.h and pretty well documented. A few usage examples can be found in the test directory, in particular, the broping tool can be used to test event transmission and reception. Have a look at the policy file broping.bro for the events that need to be defined at the peering Bro. Try broping -h for a look at the available options.

Broccoli knows two kinds of version numbers: the release version number (as in "broccoli-x.y.tar.gz", or as shipped with Bro) and the shared library API version number (as in libbroccoli.so.3.0.0). The former relates to changes in the tree, the latter to compatibility changes in the API.

Comments, feedback and patches are appreciated; please check the Bro website.


Please see the Broccoli User Manual and the Broccoli API Reference.