error with local nets definition

Zeek
1

Hi,

I am trying to run offline analysis using bro on pcap files.

I created local.bro as

redef local_nets: set[subnet] = {
a.b.c.d/24,
};

@load brolite
@load brolite-sigs

Then I am trying to use

bro -r trace1.tcpdump local.bro

but giving me errors like this

/usr/local/bro//policy/local.bro, line 1 (local_nets): error, “redef” used but not previously defined

What can I do to overcome this error.

Thanks in advance.

–uday

2

Try putting the redef after the @load commands - it needs to be defined in the @load'ed scripts before it can be redef'd.

Hope this helps.

uday chekuri wrote: