[Bro-Dev] #664: Interesting_Hostname_Login misleading

Bro Tracker bro at tracker.bro-ids.org
Sat Nov 5 12:05:26 PDT 2011


#664: Interesting_Hostname_Login misleading
---------------------+--------------------
 Reporter:  robin    |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro2.0
Component:  Bro      |    Version:
 Keywords:           |
---------------------+--------------------
 It generates messages of the from `interesting login from hostname X` with
 X the *responder* of a connection.

 {{{
   for ( host in set(c$id$orig_h, c$id$resp_h) )
                 {
        […]
                                 NOTICE([$note=Interesting_Hostname_Login,
                                         $msg=fmt("Interesting login from
 hostname: %s", hostname),
                                         $sub=hostname, $conn=c]);
                                 }
                 }

 }}}

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/664>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list