vern at icir.org
Fri Aug 12 00:57:16 PDT 2005
> Is there anyway to anonymize only IP addresses using Bro?
Basically, no. (Ruoming, please correct me if I'm wrong.) Address
anonymization only happens as a part of trace transformation, So you could
write transformation scripts that don't change anything other than addresses,
but this will only work for those protocols for which the event engine
That said, Ruoming is close to releasing a separate trace anonymization
tool (tcpmkpub) that will support this.
More information about the Bro