IPS Functionality in BRO

Zeek
1

Hi,
I was just goin through the BRO USER Manual and Found that BRO does some
amount of Prevention .
I did try "IPS" by adding the following in hot.bro .

const terminate_successful_inbound_service: table[port] of string = {
              [22/tcp] = "SSH",
} &redef;

also i did change the ssh.bro to the following .

redef restrict_filters += { ["ssh"] = "port 22" };

But in vain , i could NOT prevent the ssh traffic.
I was able to ssh to other machines and also other machines were able to
ssh to my machine.

Could somebody shed some light on this?
Any pointers about the BRO with IPS would be really helpful .

Thanks,
Anand

2

const terminate_successful_inbound_service: table[port] of string = {
              [22/tcp] = "SSH",
} &redef;

also i did change the ssh.bro to the following .

redef restrict_filters += { ["ssh"] = "port 22" };

But in vain , i could NOT prevent the ssh traffic.

Do you get any output? Is the "rst" tool in your path and setuid root so
it can forge tear-down traffic?

    Vern