<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">All of them seem to work fine here on Zeek 3 pre-release.</div><div dir="ltr"><br><blockquote type="cite">On Oct 31, 2019, at 3:33 PM, Justin Azoff <justin@corelight.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div dir="ltr">On Thu, Oct 31, 2019 at 5:55 PM James Lay <<a href="mailto:jlay@slave-tothe-box.net" target="_blank">jlay@slave-tothe-box.net</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Well here I am. Zeek 3 was released Sep 23rd, and I'm dead in the water <br>
until these are updated:<br>
<br>
<a href="https://github.com/J-Gras/bro-af_packet-plugin" rel="noreferrer" target="_blank">https://github.com/J-Gras/bro-af_packet-plugin</a></blockquote><div><br></div><div>appears to work just fine.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<a href="https://github.com/salesforce/ja3/tree/master/bro" rel="noreferrer" target="_blank">https://github.com/salesforce/ja3/tree/master/bro</a></blockquote><div><br></div><div>Other than a warning about using bro_init, works fine. The code that causes this looks like dead code that isn't even used anyway, so they can just be deleted. There's also the hosom/bro-ja3 which is a cleaned up version and works without warnings. The test suite it includes fails to run properly (fixable btest issues), but installing anyway results in a functional package.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<a href="https://github.com/J-Gras/intel-seen-more" rel="noreferrer" target="_blank">https://github.com/J-Gras/intel-seen-more</a></blockquote><div><br></div><div>Looks like this hits the issue where it depends on bro/something which are now all zeek/something I fixed this in one of my packages by just deleting the "bro/" part of the dependency but I think this is more a migration issue that zkg could help resolve.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
if anyone has inside communication channels or some other form of <br>
digital cattle prod I'd love it if you could motivate the above to get <br>
to Zeek 3 compatibility. Truth be told I haven't even been able to <br>
start testing yet due to the missing plugins I use.<br></blockquote><div><br></div><div>Well, 2 out of the 3 already work, and one just needs a minor update that I'm sure Jan would be happy to make if someone had just told him about it.</div><div><br></div></div>-- <br><div dir="ltr"><div dir="ltr">Justin</div></div></div>
<span>_______________________________________________</span><br><span>Zeek mailing list</span><br><span>zeek@zeek.org</span><br><span>http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</span></div></blockquote></body></html>