Layer 2 Info

Zeek
1

Is there any way to glean layer 2 information from bro? Or maybe a reliable means of correlating IPs to hostnames?

We are running into issues where dynamic IP addressing is severely hindering the ability to track behavior identified by analysis of bro logs.

Thanks for the help!

Luis

2

Hi Luis,

Is there any way to glean layer 2 information from bro? Or maybe a reliable
means of correlating IPs to hostnames?

Bro 2.5 (beta2 available) will support logging of MAC addresses:
https://github.com/bro/bro/blob/master/scripts/site/local.bro#L98

Best regards,
Jan

3

This may not help solve the problem you’re having but just FYI Bro 2.5 also logs VLAN ID’s now, from the new functionality section at the link below:

“Bro now tracks VLAN IDs. To record them inside the connection log, load protocols/conn/vlan-logging.bro.”

https://www.bro.org/documentation/beta/NEWS.bro.html

-Drew