[Bro] Stupid scripting question: SSH password detection limited to local networks

Robin Sommer robin at icir.org
Tue Jan 28 08:37:46 PST 2014

On Tue, Jan 28, 2014 at 10:08 -0500, Mike Patterson wrote:

> I’m thinking my problem with the test script is simply that I’m not
> running it with broctl

Yeah, networks.cfg will be used only when running from broctl. For
testing, broctl has a command "process" that processes a trace with
(almost) the same configuration that it's using when running live See
the corresponding entry in


Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin

More information about the Bro mailing list