Hi,
I’ve been trying to get this worked out but no luck yet. Any suggestions?
bash-3.00# /usr/local/bro/bin/bro -i sis0 mt
policy/hot.bro, line 78: error: unknown identifier is_local_addr, at or near “is_local_addr”
The hot.bro appears to be the same as on some other installs that I work on, but here a section.
An internal function used by check_hot.
function do_hot_check(c: connection, a: addr, t: table[addr] of string)
{
if ( a in t )
{
++c$hot;
local hot_msg = fmt("<%s>", t[a]);
append_addl(c, hot_msg);
}
}
function check_spoof(c: connection): bool
{
local orig = c$id$orig_h;
local resp = c$id$resp_h;
local service = c$id$resp_p;
if ( is_local_addr(orig) && is_local_addr(resp) &&
service !in allow_spoof_services )
{
if ( c$id$orig_p == service && orig == resp )
event conn_weird(“Land_attack”, c);
if ( same_local_net_is_spoof )
++c$hot;
}
return c$hot != 0;
}
function check_hot(c: connection, state: count): bool
{
local id = c$id;
local service = id$resp_p;
if ( service in allow_services || c$service == “ftp-data” )
return F;
if ( state == CONN_ATTEMPTED )
check_spoof(c);
else if ( state == CONN_REJECTED )
Thanks,
Jeff