[Bro] Anonymization

Vern Paxson vern at icir.org
Fri Aug 12 00:57:16 PDT 2005


> Is there anyway to anonymize only IP addresses using Bro?

Basically, no.  (Ruoming, please correct me if I'm wrong.)  Address
anonymization only happens as a part of trace transformation,  So you could
write transformation scripts that don't change anything other than addresses,
but this will only work for those protocols for which the event engine
supports transformation.

That said, Ruoming is close to releasing a separate trace anonymization
tool (tcpmkpub) that will support this.

		Vern



More information about the Bro mailing list