[Bro] Remote reconfiguration of a Bro sensor

Gaspar Modelo-Howard gmhoward at gmail.com
Mon Oct 25 20:15:11 PDT 2010


Hello,

Can someone please point to some info on how does Bro currently support
to remotely reconfigure a sensor? Any example would also be appreciated.
I want to configure Bro to allow remote reconfiguration of sensors
without shutting down the sensor. One particular case I am interested in
is telling a Bro sensor to include/exclude a .bro script while running.
For example, a sensor starts with 'bro http' and then later is
reconfigured to 'bro http ssh'.

I briefly talked to Robin and Seth on regards to this so sorry to bring
it up again. But seems like I missed some important pointers, can't find
where/how to proceed with this. Have been successful sharing state
between remote sensors, like bro-to-bro comm from 2009 workshop, but not
doing remote reconfiguration.

Many thanks,


Gaspar 




More information about the Bro mailing list