[Bro] Broadcast detection
anthony kasza
anthony.kasza at gmail.com
Tue Aug 25 10:17:19 PDT 2015
This sounds like something the Hosts module in scriptland does. If not, you
could define subnets of multicast/broadcast addresses in a script and check
on new_connection if id.orig_h or id.resp_h is in those subnets.
-AK
On Aug 25, 2015 8:51 AM, "Vito Logrillo" <vitologrillo at gmail.com> wrote:
> Hi all,
> i want to flag if a given ip is an ip broadcast/multicast or not:
> there are some built-in functions able to recognize an ip broadcast in
> Bro?
> Thanks,
> Vito
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150825/57b99f97/attachment.html
More information about the Bro
mailing list