This paper describes the basic work principle and system structure of Bro which is a very popular
opening source codes and lightweight Network Intrusion Detection System
and provides several instances of policy script for some network intrusions. It simply compares Bro with Snort. Both of them are opening sources code NIDS.