# Detect openssl heartbleed

**URL:** <https://community.zeek.org/t/detect-openssl-heartbleed/3061>\
**Category:** Zeek\
**Created:** [April 8, 2014, 8:52pm UTC](https://community.zeek.org/t/detect-openssl-heartbleed/3061 "2014-04-08T20:52:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\
**Post date:** [April 8, 2014, 8:52pm UTC](https://community.zeek.org/t/detect-openssl-heartbleed/3061/1 "2014-04-08T20:52:49Z")

</div>

```auto
I was wondering if it would be possible to detect the openssl
heartbleed attack.
In this site are details & some scripts to test this attack
[http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/](http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/)

I found a suricata sollution
[http://blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/](http://blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/)

Maybe someone has such a script for bro ?

```

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [April 8, 2014, 9:05pm UTC](https://community.zeek.org/t/detect-openssl-heartbleed/3061/2 "2014-04-08T21:05:02Z")

</div>

We just wrote a blog post about this.

See [http://blog.bro.org/2014/04/detecting-heartbleed-bug-using-bro.html](http://blog.bro.org/2014/04/detecting-heartbleed-bug-using-bro.html)

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/detect-openssl-heartbleed/3061/3 "2022-05-06T15:41:41Z")

</div>