diff --git a/net-analyzer/bro/Manifest b/net-analyzer/bro/Manifest
new file mode 100644
index 000000000..74db34096
--- /dev/null
+++ b/net-analyzer/bro/Manifest
@@ -0,0 +1,2 @@
+DIST bro-1.5-release.tar.gz 4327064 RMD160 5be7df91bfa5ea9f771b44a384488cdbae2b9a77 SHA1 eb6ce362a8ac8fda080d25b756da6d29b019b889 SHA256 9e9a34af14b6466c7253ce1d03bfd3ef586e3f765902d43981212db3de585a48
+EBUILD bro-1.5.1.ebuild 606 RMD160 8b5dbe9a5676b13b68cb258f29fc8955b8ffd7ca SHA1 f4317cf3517c775b25acdfbbf7aabe96b77d2245 SHA256 58e3df334d334f2daa3c7214cc0a4ad8ee1e146c3ade5897428bb6138772a043
diff --git a/net-analyzer/bro/bro-1.5.1.ebuild b/net-analyzer/bro/bro-1.5.1.ebuild
new file mode 100644
index 000000000..dd82ba791
--- /dev/null
+++ b/net-analyzer/bro/bro-1.5.1.ebuild
@@ -0,0 +1,27 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+EAPI="2"
+
+DESCRIPTION="a advanced intrusion detection system"
+HOMEPAGE="http://bro-ids.org/"
+# upstream doesn't know what it's packaging oO
+SRC_URI="ftp://bro-ids.org/$PN-1.5-release.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+DEPEND=""
+RDEPEND=""
+
+src_prepare() {
+	# ugly workaround
+	sed -i 's|shippedpcap broctl cluster nbdns|shippedpcap broctl cluster nbdns malloc0returnsnull|g' configure
+}
+
+src_install() {
+	DESTDIR="${D}" emake install || die "install failed"
+}