[Bro] Problem with Broccoli connection

Seth Hall seth at icir.org
Mon Dec 3 08:38:31 PST 2012


On Dec 3, 2012, at 11:28 AM, Daniel Wyschogrod <dwyschogrod at bbn.com> wrote:

> I think I've tracked down the problem, but it leads to another mystery.  In my local.bro file, as I've pointed out, I have inserted the line:

Oh, are you running this through BroControl?  BroControl configures the communication framework for you.  All you need to do is add another value to the Communication::nodes variable with the events to listen to.

redef Communication::nodes += {
       ["barnyard2"] = [$host=127.0.0.1, $class="Barnyard2", $events=/Barnyard2::.*/],
};

You *should* now be able to connect to the process, but you'll have to connect on port 47760/tcp.  Is there a particular reason that you want to change that?  You can't really do that in any BroControl deployment at the moment, and the communication code only can listen on a single port per Bro process.

This is a somewhat undefined area of operation because there hasn't been a lot of work to integrated external applications on clusters like this yet.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list