# auth\_bruteforcing.bro error
**URL:** https://community.zeek.org/t/auth-bruteforcing-bro-error/4760
**Category:** Zeek
**Created:** [April 5, 2017, 12:23pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760 "2017-04-05T12:23:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ps\_sunu](https://community.zeek.org/u/ps_sunu)
#### Post date: [April 5, 2017, 12:23pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/1 "2017-04-05T12:23:46Z")
I am using below code while running this i am getting below error from below area
**if(!auth\_success) {**
**SumStats::observe(“http.auth\_errors.attacker”,**
**[$host=to\_addr(c$http$cluster\_client\_ip)],**
**[]);**
**if ( c?$conn )**
error
**field value missing [AuthBruteforcing::c$http$cluster\_client\_ip]**
code
@load base/frameworks/notice
@load base/frameworks/sumstats
@load base/protocols/http
module AuthBruteforcing;
export {
redef enum Notice::Type += {
## Indicates that a host performing HTTP requests leading to
## excessive HTTP auth errors was detected.
HTTP\_AuthBruteforcing\_Attacker,
## Indicates that a host was seen to respond excessive HTTP
## auth errors. This is tracked by IP address as opposed to
## hostname.
HTTP\_AuthBruteforcing\_Victim,
};
# Let’s tag the http item
redef enum HTTP::Tags += {
## HTTP status code 401, describing a HTTP auth error
HTTP\_AUTH\_ERROR,
## HTTP describing a successful HTTP auth
HTTP\_AUTH\_SUCCESS,
};
redef enum Log::ID += { LOG };
type Info: record {
ts: time &log;
uid: string &log;
id: conn\_id &log &optional;
cluster\_client\_ip: string &log &optional;
status\_code: count &log &optional;
host: string &log &optional;
uri: string &log &optional;
username: string &log &optional;
auth\_success: bool &log &optional;
};
global log\_auth: event(rec: Info);
## Defines the threshold that determines if a auth bruteforcing attack
## is ongoing based on the number of requests that appear to be
## attacks.
const auth\_errors\_threshold: double = 50.0 &redef;
## Interval at which to watch for the
## :bro:id:`AuthBruteforcing::auth_errors_requests_threshold` variable to be crossed.
## At the end of each interval the counter is reset.
const auth\_errors\_interval = 5min &redef;
## Interval at which to watch for the
## :bro:id:`AuthBruteforcing::excessive_auth_errors_threshold` variable to be
## crossed. At the end of each interval the counter is reset.
const excessive\_auth\_errors\_interval = 1min &redef;
const internal\_space: subnet = [10.0.0.0/8](http://10.0.0.0/8) &redef;
const public\_space: subnet = [63.245.208.0/20](http://63.245.208.0/20) &redef;
const ignore\_host\_resp: set[addr] = { } &redef;
const ignore\_host\_orig: set[addr] = { } &redef;
}
event bro\_init() &priority=3
{
# Create auth\_bruteforcing.log
Log::create\_stream(AuthBruteforcing::LOG, [$columns=Info, $ev=log\_auth]);
# HTTP auth errors for requests FROM the same host
local r1: SumStats::Reducer = [$stream=“http.auth\_errors.attacker”, $apply=set(SumStats::SUM)];
SumStats::create([$name=“auth-http-errors-attackers”,
$epoch=auth\_errors\_interval,
$reducers=set(r1),
$threshold\_val(key: SumStats::Key, result: SumStats::Result) = {
return result[“http.auth\_errors.attacker”]$sum;
},
$threshold=auth\_errors\_threshold,
$threshold\_crossed(key: SumStats::Key, result: SumStats::Result) = {
NOTICE([$note=HTTP\_AuthBruteforcing\_Attacker,
$msg=fmt(“HTTP auth bruteforcing from attacker %s”, key$host),
$sub=fmt(“%.0f auth failed in %s”, result[“http.auth\_errors.attacker”]$sum, auth\_errors\_interval),
$src=key$host,
$n=to\_count(fmt(“%.0f”, result[“http.auth\_errors.attacker”]$sum))
]);
}]);
# HTTP errors for requests TO the same host
local r2: SumStats::Reducer = [$stream=“http.auth\_errors.victim”, $apply=set(SumStats::SUM)];
SumStats::create([$name=“auth-http-errors-victims”,
$epoch=auth\_errors\_interval,
$reducers=set(r2),
$threshold\_val(key: SumStats::Key, result: SumStats::Result) = {
return result[“http.auth\_errors.victim”]$sum;
},
$threshold=auth\_errors\_threshold,
$threshold\_crossed(key: SumStats::Key, result: SumStats::Result) = {
NOTICE([$note=HTTP\_AuthBruteforcing\_Victim,
$msg=fmt(“HTTP auth bruteforcing to victim %s”, key$host),
$sub=fmt(“%.0f auth failed in %s”, result[“http.auth\_errors.victim”]$sum, auth\_errors\_interval),
$src=key$host,
$n=to\_count(fmt(“%.0f”, result[“http.auth\_errors.victim”]$sum))
]);
}]);
}
# Make sure we have all the http info before looking for auth errors
event http\_message\_done(c: connection, is\_orig: bool, stat: http\_message\_stat)
{
# only conns we want
local ports\_ext: set[port] = { 80/tcp };
local ports\_int: set[port] = { 80/tcp, 81/tcp, 443/tcp };
if (c$id$resp\_h in ignore\_host\_resp)
return;
if (c$id$orig\_h in ignore\_host\_orig)
return;
if (((c$id$resp\_h in internal\_space) && (c$id$resp\_p in ports\_int)) || ((c$id$resp\_h in public\_space) && (c$id$resp\_p in ports\_ext))) {
if (c$http?$username && c$http?$status\_code) {
local auth\_success : bool = T;
if (c$http$status\_code == 401) {
auth\_success = F;
add c$http$tags[HTTP\_AUTH\_ERROR];
}
else if (c$http$status\_code \< 400) {
auth\_success = T;
add c$http$tags[HTTP\_AUTH\_SUCCESS];
}
if(!auth\_success) {
SumStats::observe(“http.auth\_errors.attacker”,
[$host=to\_addr(c$http$cluster\_client\_ip)],
);
if ( c?$conn )
SumStats::observe(“http.auth\_errors.victim”,
[$host=c$conn$id$resp\_h],
);
}
}
}
}
[https://github.com/michalpurzynski/bro-gramming/blob/ae37c0d6bfc62e25a797426d6791cf340b045d17/auth\_bruteforcing.bro](https://github.com/michalpurzynski/bro-gramming/blob/ae37c0d6bfc62e25a797426d6791cf340b045d17/auth_bruteforcing.bro)
---
### Author:  [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [April 5, 2017, 12:59pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/2 "2017-04-05T12:59:01Z")
cluster\_client\_ip is the user defined field, http record doesn’t have any field name “cluster\_client\_ip”.
I think what you want is c$http$id$orig\_h , if that’s what the purpose of cluster\_client\_ip is.
Also your host is “string” type, you can change it to “addr” type:
Might wanna try something like:
type Info: record {
**host: addr &log &optional;**
};
SumStats::observe(“http.auth\_errors.attacker”,
[$host=c$http$id$orig\_h],
[]);
Also, not sure how this part is working(As c doesn’t have “conn” field as well.):
if ( c?$conn )
SumStats::observe(“http.auth\_errors.victim”,
[$host=c$conn$id$resp\_h],
[]);
---
### Author:  [@ps\_sunu](https://community.zeek.org/u/ps_sunu)
#### Post date: [April 5, 2017, 1:49pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/3 "2017-04-05T13:49:34Z")
i cleared using below code
if( c$http?$cluster\_client\_ip )
---
### Author:  [@ps\_sunu](https://community.zeek.org/u/ps_sunu)
#### Post date: [April 5, 2017, 1:50pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/4 "2017-04-05T13:50:51Z")
thanks
---
### Author:  [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [April 5, 2017, 2:32pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/5 "2017-04-05T14:32:21Z")
> if( c$http?$cluster\_client\_ip )
> Though, I wonder if this condition is ever going to result in true…
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/auth-bruteforcing-bro-error/4760/6 "2022-05-06T15:44:48Z")