[Bro] Trying to drop addresses...

[Robin Sommer]

On Fri, Dec 05, 2008 at 15:43 -0600, you wrote:

>          [Drop::AddressDropped] = drop_source,

You nedd to map drop_source to the notice which you want to trigger
the drop, e.g., PortScan or AddressScan. AddressDropped is generated
when an address has been dropped *already* (which won't happen if
you don't assign drop_source to anything else). 

> Do I need to modify the notice_policy?  I don't see any NOTICE_DROP  
> examples in notice-policy.bro.

That would be the alternative. You can either return NOTICE_DROP in
the notice_policy, or assign drop_source in notice_action_filters.

Have you seen this posting about the notice framework?

http://blog.icir.org/2008/03/telling-bro-what-important.html

Robin



-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org