[Bro] Dynamically Updating Signatures With Broccoli?

Robin Sommer robin at icir.org
Tue Nov 11 19:03:20 PST 2008


On Tue, Nov 11, 2008 at 00:07 -0500, you wrote:

> The Broccoli documentation indicates that broccoli-based applications  
> can remotely configure Bro without the need for a restart.   Would it  
> be possible to dynamically send signature updates to Bro using  
> Broccoli? 

No, that's not possible. Bro doesn't have the internal
infrastructure to recompile signatures on the fly. 

At the moment, the only part of the configuration which can be
(reliably) updated on the fly are script-level variables declared as
&redef.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org


More information about the Bro mailing list