[Bro] SMB2 module

Seth Hall seth at icir.org
Mon Mar 23 06:21:50 PDT 2015


> On Mar 23, 2015, at 6:07 AM, Danilo Nicolò <dani.nicolo at gmail.com> wrote:
> 
> I'm little confused about the different behavior: if I set BRO_DNS_FAKE=1, Will dns logs be altered significantly?

No, BRO_DNS_FAKE only changes active DNS lookups.  When Bro itself goes out to lookup a name in DNS it will return junk information.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list