[Bro] IP <-> MAC Address

[Seth Hall]

> On Jun 30, 2016, at 4:19 AM, Maxime Lambert <maxime.lambert at insa-cvl.fr> wrote:
> 
> Is there a way to obtain the source and/or destination mac address from a connection record ?

This a feature in the next release of Bro.  If you use git master, you can load the "policy/protocols/conn/mac-logging.bro" script and it will add MAC address fields to your conn log.

  .Seth

--
Seth Hall * Broala * seth at broala.com * www.broala.com