[Bro] Dynamically Updating Signatures With Broccoli?

[Robin Sommer]

On Tue, Nov 11, 2008 at 00:07 -0500, you wrote:

> The Broccoli documentation indicates that broccoli-based applications  
> can remotely configure Bro without the need for a restart.   Would it  
> be possible to dynamically send signature updates to Bro using  
> Broccoli? 

No, that's not possible. Bro doesn't have the internal
infrastructure to recompile signatures on the fly. 

At the moment, the only part of the configuration which can be
(reliably) updated on the fly are script-level variables declared as
&redef.

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org