[Bro] Toggling traffic direction in reports/logs?
robin at icir.org
Mon Jan 8 16:33:57 PST 2007
On Tue, Dec 26, 2006 at 10:45 -0600, Eric Wages wrote:
> This is the exact opposite of what is the actual traffic pattern. Is
> there a way that I can tell Bro that my /28 subnet is "local" and
> everything else is "remote"? I don't seem to see anything like that
> in the configuration files.
You can redefine local_nets in site.bro.
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro