BroShell: monitor /net/bro