[Bro] Off-line analysis
vern at icir.org
Sun Dec 5 13:38:14 PST 2004
> When I try to off-line analysis with -r option, how can I use all Bro
The notion of "all Bro rules" is not that well defined. There are a large
number (100+) of policy files in policy/*.bro, some of which are incompatible
with others (for example, print-filter.bro prints the BPF filter being used
and then exits).
That said, here's what we use when to run against our internal test suite:
This winds up loading a whole lot of the analysis.
More information about the Bro