[Bro] Broadcast detection

anthony kasza anthony.kasza at gmail.com
Tue Aug 25 10:17:19 PDT 2015


This sounds like something the Hosts module in scriptland does. If not, you
could define subnets of multicast/broadcast addresses in a script and check
on new_connection if id.orig_h or id.resp_h is in those subnets.

-AK
On Aug 25, 2015 8:51 AM, "Vito Logrillo" <vitologrillo at gmail.com> wrote:

> Hi all,
> i want to flag if a given ip is an ip broadcast/multicast or not:
> there are some built-in functions able to recognize an ip broadcast in
> Bro?
> Thanks,
> Vito
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150825/57b99f97/attachment.html 


More information about the Bro mailing list