# Bro \<-\> Snort documentation

**URL:** <https://community.zeek.org/t/bro-snort-documentation/390>\
**Category:** Zeek\
**Created:** [July 13, 2003, 7:02pm UTC](https://community.zeek.org/t/bro-snort-documentation/390 "2003-07-13T19:02:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [July 13, 2003, 7:02pm UTC](https://community.zeek.org/t/bro-snort-documentation/390/1 "2003-07-13T19:02:48Z")

</div>

> signature kazaa-seen {  
> &nbsp;&nbsp;ip-proto == tcp  
> &nbsp;&nbsp;dst-ip == whatever  
> &nbsp;&nbsp;dst-port == whatever (or omitted, I guess)  
> &nbsp;&nbsp;payload /.\*kazaa regular expression/  
> &nbsp;&nbsp;eval function\_to\_execute\_when\_kazaa\_seen  
> &nbsp;&nbsp;event "kazaa seen"  
> }
> 
> The 'eval' & the 'event' are somewhat confusing. I presume that the  
> 'signature\_match' event is triggered with the string for action, but  
> when is the 'eval' called (before the event, or after), and with what  
> args?

The function specified by "eval" is called before the signature is determined  
to have triggered. It's passed in the signature\_state just as is  
signature\_match. It returns a boolean, which must be T for the signature  
to trigger.

For an example, see sig.ex.ssl-worm.bro and policy/ssl-worm.bro.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bro-snort-documentation/390/2 "2022-05-06T15:36:47Z")

</div>