[Bro] Stupid scripting question: SSH password detection limited to local networks

Robin Sommer robin at icir.org
Wed Jan 29 15:20:08 PST 2014

On Tue, Jan 28, 2014 at 12:29 -0500, you wrote:

> error in /usr/local/bro-2.2/share/bro/policy/misc/loaded-scripts.bro, line 4: syntax error, at or near “module"

Actually I get this too, just tried it. That looks like a bug. Here's
a work-around that works for me: when you run the "process" commnand,
it prints out a long command line. Copy that, leave broctl, paste it
into your shell and then move your test script from its position
somewhere in the middle to the very end.

I don't know if this helps solving the original problem but it should
tell you if broctl sets the local networks correctly.

I'm also filing a ticket for this, I believe broctl should always move
the the custom scripts to the end of the command line.


Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin

More information about the Bro mailing list