[Bro] question about ssl analyzer

jbabbin at comcast.net jbabbin at comcast.net
Tue Feb 21 18:19:50 PST 2006

I have a question about the SSL analyzer and the ssl.bro policy file. I'm trying to use this policy to track ssl certificates across a link. However, this policy seems to be broken. 

Upon starting bro 1.0 with ssl.bro enabled I get 
line 1: warning: event handlers never invoked: 
line 1: warning: account_tried
line 1: warning: ssl_ciphersuite_seen 

after the first ssl connection or sometimes the second... bro seg faults with no core or debugging information. Also I have recompiled bro with debugging enabled and retried it with no luck as well. 
Lastly, I have turned almost everything off in the policy file just to check if thats the issue as well. 

Anyone been able to run the ssl analyzer successfully? 

Jake Babbin 

More information about the Bro mailing list