bridge-firewall on Bro

Vern Paxson vern at icir.org
Sat Apr 5 11:34:46 PST 2003


For what you are doing, you will need to either edit scan.bro to
remove the hostnames, for example replacing

	const skip_scan_sources = {
	...
	};

with

	const skip_scan_sources: set[addr];

(you can't replace it with just "const skip_scan_sources = { };", because
then Bro can't figure out the variable's type); or you could arrange for
the DNS service on your box to resolve them directly via /etc/hosts.

		Vern



More information about the Bro mailing list