Install Bro - Network-based Intrusion Detection, on Fedora or Ubuntu. Bro will get installed in /usr/local/bro/ by default, unless you specified a prefix in configure as I did. I also created a bro user and group to own everything and did the make as that bro user.

Bro is intended for use by sites requiring flexible, highly customizable intrusion detection. It is important to understand that Bro has been developed primarily as a research platform for intrusion detection and traffic analysis. It is not intended for someone seeking an “out of the box” solution. Bro is designed for use by Unix experts who place a premium on the ability to extend an intrusion detection system with new functionality as needed, which can greatly aid with tracking evolving attacker techniques as well as inevitable changes to a site’s environment and security policy requirements.