[Bro] Monitoring for MAC address
zeolla at gmail.com
Thu Oct 6 14:00:02 PDT 2016
Very helpful, thank you both.
On Thu, Oct 6, 2016, 16:00 Jan Grashöfer <jan.grashoefer at gmail.com> wrote:
> > I have a use case where I would like to monitor for certain MAC addresses
> > in use. I took a look at the Intel framework
> > <
> > and
> > it doesn't seem to have a type that can handle this. Has anybody else
> > encountered a similar scenario in the past?
> I theory it should be possible to redef Intel::Type and add a type for
> MAC addresses as they are treated as strings by Bro anyway.
> > I did find this thread
> > <http://mailman.icsi.berkeley.edu/pipermail/bro/2015-July/008819.html>,
> > if I have to, I will just write a script that uses known_devices.
> Bro 2.5 will support logging of MAC addresses (see
> Enabling this you would just have to add a seen script like the
> conn-established.bro script.
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro