I'm trying to configure a bridge-firewall with the bro IDS on it to
check web traffic (for example). But I've some troubles. Actually, if
I launch bro with the http rules, due to dependences I have to load
scan rules. And the scan rules try to connect some machines... But my
aim is to have an IDS without IP address, so without connection from
and to the bridge.Due to that, bro give me a lot of warnings and is very long to
launch...I try to modify the rules via my conf file but there are some kinds I
don't understand. For examples, if I change the "skip_scan_sources" to
an empty value after loading the scan rule (loading via http rule) ;
~~~~~~~~~~~~try 127.0.0.1