[Bro] Obtain src/dst mac addrs from connection record

Matthias Vallentin vallentin at icir.org
Tue Jan 31 19:33:27 PST 2012


On Tue, Jan 31, 2012 at 6:54 PM, Seth Hall <seth at icir.org> wrote:
> It would be nice to have a script like that for our contributed scripts repository though!

We have a script in the Bro scripts repository that collects IP to MAC
mappings via DHCP ACKs and ARP replies:

    http://git.bro-ids.org/bro-scripts.git/blob/HEAD:/roam.bro

    Matthias


More information about the Bro mailing list