[Bro] Removing intel while Bro is running

John B. Althouse III sudo.darkstar at gmail.com
Thu Jul 30 10:11:52 PDT 2015


It seems that while it's possible to add to the intel list in memory while
Bro is running, it's not possible to remove.

That is, if I remove something from the intel file because it's generating
too many false positives, I have to restart Bro in order for it to take
effect.

Is there anything I can do to fix this? I'd rather not restart Bro and lose
connection states.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150730/c7983eeb/attachment.html 


More information about the Bro mailing list