[Bro] IPS Functionality in BRO

Anandraj anandrajm at fastmail.fm
Tue Aug 1 08:59:57 PDT 2006

I was just goin through the BRO USER Manual and Found that BRO does some
amount of Prevention .
I did try "IPS" by adding the following in hot.bro .

const terminate_successful_inbound_service: table[port] of string = {
              [22/tcp] = "SSH",
} &redef;

also i did change the ssh.bro to the following .

redef restrict_filters += { ["ssh"] = "port 22" };

But in vain , i could NOT prevent the ssh traffic.
I was able to ssh to other machines and also other machines were able to
ssh to my machine.

Could somebody shed some light on this?
Any pointers about the BRO with IPS would be really helpful .


http://www.fastmail.fm - Access all of your messages and folders
                          wherever you are

More information about the Bro mailing list