# create team for update snort2bro script signature ? **URL:** \ **Category:** Zeek\ **Created:** [November 6, 2008, 3:57pm UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438 "2008-11-06T15:57:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rmkml](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rmkml](https://community.zeek.org/u/rmkml)\ **Post date:** [November 6, 2008, 3:57pm UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/1 "2008-11-06T15:57:01Z")
Hi, Congratulations Bro Team for a new version 1.4 ! I expected than bro is not a snort rules parser, but its interesting porting snort rules directly to bro... Im interested by update snort2bro signature, Im known snort rules, but I don't known how its implemented on bro script! Anyone interested ? First question: bro contains two script, one in perl and one in python,   what is the "best" ? Second question: function not supported: 1)byte\_test() is not supported, but it is possible bro contains similar function ? 2)byte\_jump() is not supported, but it is possible bro contains similar function ? Regards Rmkml [Crusoe-Researches.com](http://Crusoe-Researches.com) ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 7, 2008, 6:49am UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/2 "2008-11-07T06:49:23Z")
> First question: bro contains two script, one in perl and one in python, Which Perl script are you refering to? > 1)byte\_test() is not supported, but it is possible bro contains similar function ? > 2)byte\_jump() is not supported, but it is possible bro contains similar function ? No, sorry, there is no such functionality yet. Robin ---
**Author:** ![rmkml](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rmkml](https://community.zeek.org/u/rmkml)\ **Post date:** [November 7, 2008, 5:56am UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/3 "2008-11-07T05:56:05Z")
Hi Robin, thx for reply, bro-1.4/scripts/s2b/bin/s2b.pl ? do you known if it is possible adding this features ? Regards Rmkml [Crusoe-Researches.com](http://Crusoe-Researches.com) ---
**Author:** ![rmkml](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rmkml](https://community.zeek.org/u/rmkml)\ **Post date:** [November 7, 2008, 6:31am UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/4 "2008-11-07T06:31:11Z")
two function like exist on bro policy but not avalaible for signatures ?: -snort threshold() =\> it appears (\*count\*) on policy/signatures.bro but not on src/rule-scan.l ? -snort flowbits:noalert =\> it appears (SigAction: SIG\_QUIET) on policy/signatures.bro but not on src/rule-scan.l ? Regards Rmkml [Crusoe-Researches.com](http://Crusoe-Researches.com) ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 10, 2008, 6:32am UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/5 "2008-11-10T06:32:21Z")
> bro-1.4/scripts/s2b/bin/s2b.pl ? Ah, I see. That is actually a wrapper around the Python snort2bro which does some stuff on top of it. > do you known if it is possible adding this features ? Not sure. These options, iirc, are using packet-semantics which are hard to emulate in Bro's stream-model. They might be some approximation though which works suffiently well, don't know. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/create-team-for-update-snort2bro-script-signature/1438/6 "2022-05-06T15:38:45Z")