[Bro] Dynamically Updating Signatures With Broccoli?
robin at icir.org
Tue Nov 11 19:03:20 PST 2008
On Tue, Nov 11, 2008 at 00:07 -0500, you wrote:
> The Broccoli documentation indicates that broccoli-based applications
> can remotely configure Bro without the need for a restart. Would it
> be possible to dynamically send signature updates to Bro using
No, that's not possible. Bro doesn't have the internal
infrastructure to recompile signatures on the fly.
At the moment, the only part of the configuration which can be
(reliably) updated on the fly are script-level variables declared as
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro