Topic says it…I have the excellent smtp-embedded-url-bloom.bro which I use almost every day for looking up links. Upon upgrading to 2.4 I see:
error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line 40: value used but not set (bloomfilter_basic_init)
warning in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line 73: deprecated (split)
I read in the release notes that split was going away. So now, what do I use to fix it? I’m including this in the email as I’m not able to find it online. Thank you.
James
smtp-embedded-url-bloom.bro (7.09 KB)
Thanks Chris and Vlad, changing split_string fixed the warning, but did not fix the error at line 40 which halts bro from running. Any reason why:
global mail_links = bloomfilter_basic_init(0.00000001, 10000000) ;
causes this issue? This worked just fine with 2.3.2. Thank you.
James
Looks like this showed up last year:
http://mailman.icsi.berkeley.edu/pipermail/bro/2014-October/007662.html
Is there something I need to do on my end? Thank you.,
James
Sorry for catching up on this late.
I take you got script working now. If not, let me know, I will send a revised version.
Thanks,
Aashish
I have not…the split issue is fine, the
error in /usr/local/bro/share/bro/site/./smtp-embedded-url-bloom.bro, line 40 : value used but not set (bloomfilter_basic_init)
is not. Thank you.
James
OK, I have updated the script on git-hub. Should work now.
Let me know if you still see problems:
https://github.com/initconf/smtp-analysis/blob/master/smtp-embedded-url-bloom.bro
Thanks,
Aashish
Thank you so much Aashish…that completely fixed it up.
James
Jumping back in here for a moment, there were some changes with how and when bloom filters can be initialized in 2.4 and this script took advantage of an accidental “feature”. 
.Seth
Thanks for expanding on this Seth…it helps my understanding.
James