that brought you tcpdump, libpcap, and flex. Bro is documented in the the USENIX 1998 Security Conference proceedings.