Few questions...

[Jim Barlow]

Our site has been trying out some IDS packages in the last year and one
of them has been bro.  After using it for over 6 months I have a number of
questions about it and thought I'd post these to the email list.

Is there a main Bro web page? (besides Vern's homepage)  Anything like
www.bro-ids.org?

Does anyone keep a repository of modules, or is anyone writing/creating new
bro modules?  For instance the code red one could/should easily be modified
for nimda or any other variant.  Anyone done this?

How many sites are actually using Bro?  How many people are on this mailing
list?  I don't want to know who, but it might give people a feeling of how
many users are out there using this package.

>From what experience I have using bro I think it's really good.  However, I
see much more advancement/development on packages like Snort, which seem to
have a much higher (more involved?) user community.


-- 
James J. Barlow   <jbarlow at ncsa.uiuc.edu>
Senior System/Security Engineer
National Center for Supercomputing Applications    Voice : (217)244-6403
605 East Springfield Avenue   Champaign, IL 61820   Cell : (217)840-0601
http://www.ncsa.uiuc.edu/~jbarlow                    Fax : (217)244-1987