[Bro] Detecting heartbleed activity

Justin Azoff JAzoff at albany.edu
Thu Apr 10 11:40:53 PDT 2014


On Thu, Apr 10, 2014 at 02:32:29PM -0400, John Hoyt wrote:
> Thanks Justin,
> 
> I changed it to what you listed, but I'm still getting the following error:
> 
> error in /bro/share/bro/site/local.bro, line 95: unknown identifier
> Heartbleed::SSL_Heartbeat_Attack_Success, at or near
> "Heartbleed::SSL_Heartbeat_Attack_Success"

Do you have

@load policy/protocols/ssl/heartbleed

at some point before that?

-- 
-- Justin Azoff



More information about the Bro mailing list