I'm not sure if this of value to anyone, but I thought I'd pass it on. I
recently had a need to review arp traffic and re-wrote the old arp.bro
policy script to use the new Logging framework in 2.0-beta. I made a few
additional changes as well with how the state information is stored.
load.bro|attachment (13 Bytes)
main.bro (7.14 KB)
Awesome, thanks! I was going to be bringing the ARP analysis script back soon (maybe for 2.1) and you've made it easier now. I'll make sure you get credit in the CHANGE file when it gets added back.
Thanks,
.Seth
No problem... Glad I could help. I'll make sure to let you know if I
make any changes to it. Until then, maybe I'll work on converting some
of the others.
** Seth Hall <seth@icir.org> [2011-11-22 12:30:09 -0500] **