[Bro] invoking an analayzer without the default policy script?

Mike Wood muscletot at gmail.com
Tue Dec 4 15:43:37 PST 2007


I would like to be able to write nothing but

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count,
                    qclass: count) {
    print fmt("dns: %s", query);
}

in my policy script, and get a print out for every DNS request... but
this dns_request handler does not get called unless I add

@load dns

at the top.

I don't really want all the other stuff that comes with the dns.bro
script. Is there any way around this?

Thanks,
Mike



More information about the Bro mailing list