[Bro] Adding new signatures

Robin Sommer robin at icir.org
Tue Jun 27 11:50:11 PDT 2006

On Tue, Jun 27, 2006 at 08:01 -0700, you wrote:

> Could somebody shed some light on this , please correct me if i m wrong
> in the process of adding the signatures or, my understanding since ,i m
> a newbie.

Not sure if I understand the problem. Are you asking whether you
added your own signatures in the correct way? In general, you can
put custom signatures into any file and then give that to Bro via
either the -s command line option or by redefining the script
variable "signature_files". Ideally, you shouldn't change the
shipped signature files to avoid problems when updating to newer
versions of Bro. 

> Though my final intention is to make the BRO-IDS support bittorrent
> protocol.

Sounds great!


Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICIR/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list