# Bro Signature Question

**URL:** <https://community.zeek.org/t/bro-signature-question/2522>\
**Category:** Zeek\
**Created:** [December 18, 2012, 9:17pm UTC](https://community.zeek.org/t/bro-signature-question/2522 "2012-12-18T21:17:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [December 18, 2012, 9:17pm UTC](https://community.zeek.org/t/bro-signature-question/2522/1 "2012-12-18T21:17:32Z")

</div>

Hello Bro Community,

I am looking for help in understanding more about Bro's signatures and  
in troubleshooting a problem I have encountered.  
I would like to write chains of signatures using 'requires-signature'  
in hopes of easing maintainability and increasing signature matching  
speed.  
Below are the beginning of the chains I have written.

signature prematch\_udp  
{  
&nbsp;&nbsp;ip-proto == udp  
}

signature prematch\_tcp  
{  
&nbsp;&nbsp;ip-proto == tcp  
&nbsp;&nbsp;tcp-state established, originator  
}

signature prematch\_tcp\_80  
{  
&nbsp;&nbsp;requires-signature prematch\_tcp  
&nbsp;&nbsp;dst-port == 80  
}

signature evil  
{  
&nbsp;&nbsp;requires-signature prematch\_tcp\_80  
&nbsp;&nbsp;payload /GET /  
&nbsp;&nbsp;event "evil"  
}

signature otherEvil  
{  
&nbsp;&nbsp;requires-signature prematch\_tcp  
&nbsp;&nbsp;dst-port == 8080  
&nbsp;&nbsp;payload /GET /  
&nbsp;&nbsp;event "otherEvil"  
}

I understand a signature will 'fire' once per stream, but in this  
scenario different signatures should be 'firing' for a single stream.  
I have tested these signatures and cannot get them to match a stream  
unless I remove the requires-signature options. Does anyone have any  
advice or thoughts on why this would be happening?

Many thanks,

-AK

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/bro-signature-question/2522/2 "2022-05-06T15:40:43Z")

</div>

Closed on May 6, 2022, 3:40pm UTC