[Bro] Toggling traffic direction in reports/logs?

Robin Sommer robin at icir.org
Mon Jan 8 16:33:57 PST 2007


On Tue, Dec 26, 2006 at 10:45 -0600, Eric Wages wrote:

> This is the exact opposite of what is the actual traffic pattern. Is  
> there a way that I can tell Bro that my /28 subnet is "local" and  
> everything else is "remote"? I don't seem to see anything like that  
> in the configuration files.

You can redefine local_nets in site.bro.

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list