[Bro] Stupid scripting question: SSH password detection limited to local networks

Mike Patterson mike.patterson at uwaterloo.ca
Wed Jan 29 16:27:40 PST 2014

> However, if I write a test script:
> ----
> @load base/utils/site
> print Site::local_nets;
> ----
> and run “bro test.bro” output is empty unless I first redef Site::local_nets += {}; with my ranges.
> Obviously I’m doing something incorrect, but which is the most correct way to fix it? redef local_nets in my local.bro, or have I mistaken the format of the networks.cfg file? It contains:

Bernhard points out that if the script is:
event bro_init()
print Site::local_nets;
everything works just ducky that way too (with process).

. . . and I’m still trying to trigger the heuristics. :)


More information about the Bro mailing list