Question about port scan detection and raising alarms

Zeek
1

Hello!
I wonder, is the port scan detection functionality present in bro 2.0,
and if it is, how to enable it?
I am starting bro with scripts/test-all-policy.bro, which should (I
suppose) enable all built-in analyzers, then perform a standart nmap SYN
scan of the host running bro. After that, I shutdown bro and examine the
results.
However, nothing related to scanning is shown in notice.log, and the
alarm.log even doesn't get created. Am I missing some important steps here?

I'm running bro directly via cli: bro -i eth0 scripts/test-all-policy.bro

As a side question: what is the easiest way to test bro's
alarm-triggering? What I need is a sample pcap file (or some kind of
instructions), which will trigger alarms in a default bro configuration
(freshly-build bro run with scripts that are distributed with bro itself).

Thanks

2

I wonder, is the port scan detection functionality present in bro 2.0,

No, the scan detector isn't in there yet. We're planing to rewrite it
using the new frameworks, but than didn't make it into 2.0 anymore.

We have however ported the 1.5 version over to Bro 2.0 and put it into
the contributed scripts repository for now, see here:

    http://git.bro-ids.org/bro-scripts.git/tree

You can download scan.bro from there, put it into your site directory,
and then load it from local.bro. The script hasn't seen much testing
yet, but it's basically the 1.5 version with a few little pieces
updated to the 2.0 API changes.

As a side question: what is the easiest way to test bro's
alarm-triggering?

The easiest way would be without any trace at all, just some lines of
script code directly triggering an alarm. There are a few tests in the
test suite which do that. Try this:

    bro <bro-distribution>/testing/btest/scripts/base/frameworks/notice/suppression.bro

Then look at notice.log.

Robin