[Bro] Scanned Unique Host

Hector Pena hector.pena at relativity.com
Wed Oct 25 14:40:11 PDT 2017


Is there a way to view which host were scanned when receiving a notice for the scan.bro script? We have been receiving a lot of notices lately for “x.x.x.x scanned at least X unique hosts on port X in Xtime”. I cannot seem to find a good way to determine which host were scanned by the host machine.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171025/109f1bb5/attachment.html 

More information about the Bro mailing list