[Bro] ShellShock Detector for Bro

Alec Dhuse dhuse at american.edu
Mon Sep 29 11:11:54 PDT 2014


Hi everyone, I'm trying to get the ShellShock Detector for Bro (
https://github.com/broala/bro-shellshock) installed. Currently I have the 
files on my Bro box and the config updated.  But when I try to check the 
script I get an error with an unrelated library, see below:

$ ./broctl check
manager failed.
   error in /.../bro/share/bro/base/frameworks/sumstats/./main.bro, line 
191 and 
/.../bro/share/bro/base/frameworks/sumstats/./plugins/./average.bro, line 
17: incompatible types (hook(r:record { stream:string; apply:set[enum]; 
pred:function(key:record { str:string; host:addr; }; obs:record { 
num:count; dbl:double; str:string; };) : bool; 
normalize_key:function(key:record { str:string; host:addr; };) : record { 
str:string; host:addr; }; sid:string; }; val:double; data:record { 
num:count; dbl:double; str:string; }; rv:record { begin:time; end:time; 
num:count; average:double; };) : bool and hook(r:record { stream:string; 
apply:set[enum]; pred:function(key:record { str:string; host:addr; }; 
obs:record { num:count; dbl:double; str:string; };) : bool; 
normalize_key:function(key:record { str:string; host:addr; };) : record { 
str:string; host:addr; }; sid:string; }; val:double; obs:record { 
num:count; dbl:double; str:string; }; rv:record { begin:time; end:time; 
num:count; average:double; };) : bool)
proxy-1 failed.

I'm stuck at this point, so any help is appreciated.

Thanks!

 - Alec
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140929/d5d0f18f/attachment.html 


More information about the Bro mailing list