Is there anyway to anonymize only IP addresses using Bro?
Basically, no. (Ruoming, please correct me if I'm wrong.) Address
anonymization only happens as a part of trace transformation, So you could
write transformation scripts that don't change anything other than addresses,
but this will only work for those protocols for which the event engine
supports transformation.
That said, Ruoming is close to releasing a separate trace anonymization
tool (tcpmkpub) that will support this.
Vern