# bro ids icmp and attack signatures **URL:** \ **Category:** Zeek\ **Created:** [May 5, 2016, 2:42pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141 "2016-05-05T14:42:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Dr\_Mostafa\_Abdallah](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Dr\_Mostafa\_Abdallah](https://community.zeek.org/u/Dr_Mostafa_Abdallah)\ **Post date:** [May 5, 2016, 2:42pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141/1 "2016-05-05T14:42:32Z")
Dear All, I am new to bro ids , I installed successfully bro ids , and added a tap to network to it , and for example if I accessed a website on a machine I can see in http.log the website I accessed and if the wqebsite is ssl i can see in ssl.lot and x509.log the certificate info my question is : I want when I ping i see a notification for this ping (I tried and could not find) can I use signatures like snort with bro that generate logs when receiving an attack and generate log with signature ID Please provide reply with some details as I am new to bro. Best Regards, Eng. Mostafa Abdallah Ammar,Msc. Information Security and Auditing Supervisor CCIE security #23971 Arab Academy For Science And Technology & maritime Transport Computer Networks & Data Center (CNDC) Mobile: 002 01001983674 ---
**Author:** ![Dr\_Mostafa\_Abdallah](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Dr\_Mostafa\_Abdallah](https://community.zeek.org/u/Dr_Mostafa_Abdallah)\ **Post date:** [May 9, 2016, 1:20pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141/2 "2016-05-09T13:20:49Z")
Dear All, I tried the following script icmptest.bro (attached) while running remote syslog, all the messages on syslog are regarding ipv6 and not ipv4 is there an explanation for that . 05-09-2016 14:56:23 Local7.Info 10.0.1.153 May 9 14:55:45 ubuntu-HVM-domU bro\_notice: 1462798535.800222 - - - - - - - - - DetectICMPSHell:: ICMP connection threshold exceeded : fe80::1d26:ba55:fc1c:4a8 - - - - - bro Notice::ACTION\_LOG 3600.000000 F - - - - - Best Regards, Eng. Mostafa Abdallah Ammar,Msc. Information Security and Auditing Supervisor CCIE security #23971 Arab Academy For Science And Technology & maritime Transport Computer Networks & Data Center (CNDC) Mobile: 002 01001983674 [icmptest.bro](https://community.zeek.org/uploads/short-url/a3fa1YYCM0AtP64t7iodDBlmjPl.bro) (4.37 KB) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 10, 2016, 4:09pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141/3 "2016-05-10T16:09:04Z")
I would look into what icmp messages you are seeing over ICMP that is causing this. This is probably just due to some aspect of how router solicitation or neighbor solicitation happens. I would also create a pcap containing a test case where you know this to trigger correctly so that you can have a repeatable test.   .Seth ---
**Author:** ![Dr\_Mostafa\_Abdallah](https://avatars.discourse-cdn.com/v4/letter/d/dbc845/32.png) [@Dr\_Mostafa\_Abdallah](https://community.zeek.org/u/Dr_Mostafa_Abdallah)\ **Post date:** [May 10, 2016, 7:41pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141/4 "2016-05-10T19:41:16Z")
Dear Seth, Thanks for your kind reply , finally it is solved and I can see logs for the icmp echo request and echo response , I was not putting the notice action correctly under the echo request event .kindly find attached file after editing for any one who follows case . Now I can print time in network time format in logs is there a way to transfer it to human readable format? Best Regards, Eng. Mostafa Abdallah Ammar,Msc. Information Security and Auditing Supervisor CCIE security #23971 Arab Academy For Science And Technology & maritime Transport Computer Networks & Data Center (CNDC) Mobile: 002 01001983674 [icmptest.bro](https://community.zeek.org/uploads/short-url/8JVPn0G3E82IwybrgRFqrp2lfbb.bro) (4.6 KB) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-ids-icmp-and-attack-signatures/4141/5 "2022-05-06T15:43:39Z")