[Bro] A question about loading signature files

Robin Sommer robin at icir.org
Wed Oct 19 18:56:33 PDT 2011


On Thu, Oct 20, 2011 at 00:02 +0800, you wrote:

> However, when Bro loaded test.bro, many errors like
> "smtp_servers(http_servers ...) didn't defined".

These are defined in snort.bro, you can just load that.

However, frankly, I don't recommend using the Snort signature at all
anymore. They are not only very old, but also generally not really
useful with Bro.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list