[Bro] IPS Functionality in BRO

[Anandraj]

Hi,
I was just goin through the BRO USER Manual and Found that BRO does some
amount of Prevention .
I did try "IPS" by adding the following in hot.bro .

const terminate_successful_inbound_service: table[port] of string = {
              [22/tcp] = "SSH",
} &redef;

also i did change the ssh.bro to the following .

redef restrict_filters += { ["ssh"] = "port 22" };

But in vain , i could NOT prevent the ssh traffic.
I was able to ssh to other machines and also other machines were able to
ssh to my machine.

Could somebody shed some light on this?
Any pointers about the BRO with IPS would be really helpful .

Thanks,
Anand




-- 
http://www.fastmail.fm - Access all of your messages and folders
                          wherever you are