[Bro] Broadcast detection
anthony.kasza at gmail.com
Tue Aug 25 10:17:19 PDT 2015
This sounds like something the Hosts module in scriptland does. If not, you
could define subnets of multicast/broadcast addresses in a script and check
on new_connection if id.orig_h or id.resp_h is in those subnets.
On Aug 25, 2015 8:51 AM, "Vito Logrillo" <vitologrillo at gmail.com> wrote:
> Hi all,
> i want to flag if a given ip is an ip broadcast/multicast or not:
> there are some built-in functions able to recognize an ip broadcast in
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro