[Bro-Dev] Status of anonymization framework

Matthias Vallentin vallentin at icir.org
Sun Nov 20 17:57:44 PST 2011


I am about to document the following functions:

  preserve_prefix(a: addr, width: count): any
  preserve_subnet(sn: subnet): any
  anonymize_addr(a: addr, cl: IPAddrAnonymizationClass): addr

I tried to play with them a bit but they don't seem to work out of the
box. When I run

    preserve_prefix(1.2.3.4, 8);
    print anonymize_addr(1.2.3.4, ORIG_ADDR);
    print anonymize_addr(1.2.3.4, RESP_ADDR);
    print anonymize_addr(1.2.3.4, OTHER_ADDR);

I get the following output:

    1.2.3.4/8
    1.2.3.4
    1.2.3.4
    1.2.3.4

Am I misusing the functions or have they been lost behind in the process
of getting ready for 2.0?

    Matthias


More information about the bro-dev mailing list