Bro as an IPS

Zeek
1

Po-Ching,

Unfortunately that forum is referencing old information from a previous
generation of our site . But I was able to dig this up using the Way Back
Machine:

https://web.archive.org/web/20071029084731/http://www.bro-ids.org/bro-works
hop-2007/slides/Bro-IPS.pdf

Does this help answer your question?

Thanks,
Jeannette

2

Bro really isn't an IPS, and that breaks the model of how Bro works. That said in the future our work with netmap and SDN technologies could allow you to do such things. I could see Bro as controlling a SDN firewall for example.