Error with Multiple_Sig_Responders

Development
1

We noticed that one of our hosts was causing this error to be thrown

1360776820.430495 Reporter::ERROR non-optional field “ts” missing in initialization ([note=Signatures::Multiple_Sig_Responders, src_addr=, sig_id=, event_msg=, host_count=5, sub_msg= has triggered signature on 5 hosts])

I looked into it, and it looks to me like Multiple_Sig_Responders is in fact missing that field.

— a/scripts/base/frameworks/signatures/main.bro
+++ b/scripts/base/frameworks/signatures/main.bro
@@ -270,7 +270,7 @@
orig, sig_id, hcount);

Log::write(Signatures::LOG,

  • [$note=Multiple_Sig_Responders,
  • [$ts=network_time(), $note=Multiple_Sig_Responders,
    $src_addr=orig, $sig_id=sig_id, $event_msg=msg,
    $host_count=hcount, $sub_msg=horz_scan_msg]);