# Bro as an IPS

**URL:** <https://community.zeek.org/t/bro-as-an-ips/3184>\
**Category:** Zeek\
**Created:** [July 17, 2014, 1:07pm UTC](https://community.zeek.org/t/bro-as-an-ips/3184 "2014-07-17T13:07:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dopheide\_Jeannette\_M](https://avatars.discourse-cdn.com/v4/letter/d/2bfe46/32.png) [@Dopheide\_Jeannette\_M](https://community.zeek.org/u/Dopheide_Jeannette_M)\
**Post date:** [July 17, 2014, 1:07pm UTC](https://community.zeek.org/t/bro-as-an-ips/3184/1 "2014-07-17T13:07:09Z")

</div>

Po-Ching,

Unfortunately that forum is referencing old information from a previous  
generation of our site . But I was able to dig this up using the Way Back  
Machine:

[https://web.archive.org/web/20071029084731/http://www.bro-ids.org/bro-works](https://web.archive.org/web/20071029084731/http://www.bro-ids.org/bro-works)  
hop-2007/slides/Bro-IPS.pdf

Does this help answer your question?

Thanks,  
Jeannette

---

<div class="post-metadata">

**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\
**Post date:** [July 17, 2014, 1:35pm UTC](https://community.zeek.org/t/bro-as-an-ips/3184/2 "2014-07-17T13:35:57Z")

</div>

Bro really isn't an IPS, and that breaks the model of how Bro works. That said in the future our work with netmap and SDN technologies could allow you to do such things. I could see Bro as controlling a SDN firewall for example.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-as-an-ips/3184/3 "2022-05-06T15:41:54Z")

</div>