# IPS Functionality in  BRO

**URL:** <https://community.zeek.org/t/ips-functionality-in-bro/1004>\
**Category:** Zeek\
**Created:** [August 1, 2006, 3:59pm UTC](https://community.zeek.org/t/ips-functionality-in-bro/1004 "2006-08-01T15:59:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anandraj](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Anandraj](https://community.zeek.org/u/Anandraj)\
**Post date:** [August 1, 2006, 3:59pm UTC](https://community.zeek.org/t/ips-functionality-in-bro/1004/1 "2006-08-01T15:59:57Z")

</div>

Hi,  
I was just goin through the BRO USER Manual and Found that BRO does some  
amount of Prevention .  
I did try "IPS" by adding the following in hot.bro .

const terminate\_successful\_inbound\_service: table[port] of string = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[22/tcp] = "SSH",  
} &redef;

also i did change the ssh.bro to the following .

redef restrict\_filters += { ["ssh"] = "port 22" };

But in vain , i could NOT prevent the ssh traffic.  
I was able to ssh to other machines and also other machines were able to  
ssh to my machine.

Could somebody shed some light on this?  
Any pointers about the BRO with IPS would be really helpful .

Thanks,  
Anand

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [August 2, 2006, 6:00am UTC](https://community.zeek.org/t/ips-functionality-in-bro/1004/2 "2006-08-02T06:00:06Z")

</div>

> const terminate\_successful\_inbound\_service: table[port] of string = {  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[22/tcp] = "SSH",  
> } &redef;
> 
> also i did change the ssh.bro to the following .
> 
> redef restrict\_filters += { ["ssh"] = "port 22" };
> 
> But in vain , i could NOT prevent the ssh traffic.

Do you get any output? Is the "rst" tool in your path and setuid root so  
it can forge tear-down traffic?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/ips-functionality-in-bro/1004/3 "2022-05-06T15:37:56Z")

</div>