# Bro as an IPS

**URL:** <https://community.zeek.org/t/bro-as-an-ips/3183>\
**Category:** Zeek\
**Created:** [July 16, 2014, 1:25pm UTC](https://community.zeek.org/t/bro-as-an-ips/3183 "2014-07-16T13:25:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Po-Ching\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@Po-Ching\_Lin](https://community.zeek.org/u/Po-Ching_Lin)\
**Post date:** [July 16, 2014, 1:25pm UTC](https://community.zeek.org/t/bro-as-an-ips/3183/1 "2014-07-16T13:25:58Z")

</div>

Dear all,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;We would like to use Bro as an IPS, which reads packets from  
netfilter, ipfw, or something like that, and may drop packets when  
some conditions are met. Somebody refers to an old presentation at  
Bro workshop 2007, but the link has been broken. Is there any ready-to-use  
solution for this purpose, or should we resort to modifying the source code?  
Any suggestion is appreciated.

Po-Ching

---

<div class="post-metadata">

**Author:** ![Dopheide\_Jeannette\_M](https://avatars.discourse-cdn.com/v4/letter/d/2bfe46/32.png) [@Dopheide\_Jeannette\_M](https://community.zeek.org/u/Dopheide_Jeannette_M)\
**Post date:** [July 16, 2014, 6:01pm UTC](https://community.zeek.org/t/bro-as-an-ips/3183/2 "2014-07-16T18:01:58Z")

</div>

Hello Po-Ching,

Will you point me to the page you were on when you found the broken link?  
I'm not able to find this broken link.

Thanks,  
Jeannette

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-as-an-ips/3183/3 "2022-05-06T15:41:54Z")

</div>