[Bro] invoking an analayzer without the default policy script?
Mike Wood
muscletot at gmail.com
Tue Dec 4 15:43:37 PST 2007
I would like to be able to write nothing but
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count,
qclass: count) {
print fmt("dns: %s", query);
}
in my policy script, and get a print out for every DNS request... but
this dns_request handler does not get called unless I add
@load dns
at the top.
I don't really want all the other stuff that comes with the dns.bro
script. Is there any way around this?
Thanks,
Mike
More information about the Bro
mailing list