[Bro] Dynamically Updating Signatures With Broccoli?

Robin Sommer robin at icir.org
Tue Nov 11 19:03:20 PST 2008

On Tue, Nov 11, 2008 at 00:07 -0500, you wrote:

> The Broccoli documentation indicates that broccoli-based applications  
> can remotely configure Bro without the need for a restart.   Would it  
> be possible to dynamically send signature updates to Bro using  
> Broccoli? 

No, that's not possible. Bro doesn't have the internal
infrastructure to recompile signatures on the fly. 

At the moment, the only part of the configuration which can be
(reliably) updated on the fly are script-level variables declared as


Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list