Hi,
I'm running Bro 1.4-release and tried to use scan.bro as
BRO_START_POLICY. I get an error on startup, however:
chris@charon:~/sw/bro$ sudo ~/sw/bro/etc/bro.rc start
bro.rc: Starting /home/chris/sw/bro/bin/bro -W -i ne2 scan.bro
BROPATH: /home/chris/sw/bro/share/bro/site:/home/chris/sw/bro/share/bro:/home/chris/sw/bro/share/bro/sigs:/home/chris/sw/bro/share/bro/time-machine
/home/chris/sw/bro/share/bro/scan.bro, line 560: error: unknown identifier conn_state, at or near "conn_state"
Loading the conn.bro script in scan.bro helps (though I'm not sure if
this is the right thing to do). Bro is starting without complaining now
and port scans are being detected.
Cheers,
Christoph
scan_bro.patch (251 Bytes)