# Question on bro anonymization **URL:** \ **Category:** Zeek\ **Created:** [July 23, 2005, 2:44pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817 "2005-07-23T14:44:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Roger\_Winslow](https://avatars.discourse-cdn.com/v4/letter/r/c57346/32.png) [@Roger\_Winslow](https://community.zeek.org/u/Roger_Winslow)\ **Post date:** [July 23, 2005, 2:44pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/1 "2005-07-23T14:44:47Z")
Are you running on a fairly quiet link? If so it can take a long time for packets to start showing up in the logs as data is flushed to files when the handles fill, not when data arrives. Try this in your site policy @load file-flush # flush file writes at 10 second intervals This will flush data to files every ten seconds. Note that the timer used here is network\_time(). This means that if no data arrives time does not increment and nothing gets flushed to files. This policy should only be used on links that are not very busy as the file flushing can get expensive the more data there is. Have you verified that Bro is actually running after you start it? Try -\> "./bro.rc status" If it shows not running then take a look at syslog or the info file. Also make sure Bro is listening on the interface you expect. Check the info file for what interfaces Bro thinks it's listening on. ---
**Author:** ![Antonatos\_Spiros](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Antonatos\_Spiros](https://community.zeek.org/u/Antonatos_Spiros)\ **Post date:** [July 23, 2005, 3:24pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/2 "2005-07-23T15:24:10Z")
I read traffic from a 2GB trace but my problem is I don't have any example policy scripts that can help me write anonymization policies. Antonatos Spiros ---
**Author:** ![Martin\_Casado](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@Martin\_Casado](https://community.zeek.org/u/Martin_Casado)\ **Post date:** [July 23, 2005, 8:05pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/3 "2005-07-23T20:05:29Z")
What level of anonymization are you attempting to do? If your goal is to scramble the IP addresses you can just set anonymize\_ip\_addr to true (see policy/anon.bro). If you are interested in saniting application level data, take a look at policy/ftp-anon.bro. Note that there is a bug in the TCP rewriter which keeps data from being written to the transformation traces (remove the assert in TCP\_Rewriter.cc line 721 to change it to next\_packet-\>AppendData(data, left); ) and .. of course for rewriting, use -A from the command line. cheers, .martin ---
**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\ **Post date:** [July 24, 2005, 12:33am UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/4 "2005-07-24T00:33:31Z")
Hi, Antonatos, > I read traffic from a 2GB trace but my problem is I don't have any example > policy scripts that can help me write anonymization policies. You may want to check out ftp-anonymization.bro as an example (there is also a paper by Vern and I explaining the anonymization process). Besides, http- rewriter.bro is also an example of application level trace rewriting, though it does not attempt to anonymize the trace. I wonder what kind of anonymization you are planning to perform: 1. Do you want to keep TCP/UDP payloads? If you want to keep only the TCP/IP headers, you can use tools such as tcpdpriv or our about-to-release tool tcpmkpub. 2. If you are trying to anonymize the payloads, Bro will probably be the best tool. But which application protocol do you have in the trace? HTTP? SMTP? or something else? Thanks, Ruoming ---
**Author:** ![Antonatos\_Spiros](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Antonatos\_Spiros](https://community.zeek.org/u/Antonatos_Spiros)\ **Post date:** [July 24, 2005, 9:29am UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/5 "2005-07-24T09:29:01Z")
I want to make a complex policy: First of all, in the headers I want sequential numbering to integers and set the TTL and IP identification number to constant values. In case of HTTP I want to remove cookies and randomize URL. In case of FTP randomize the user name, password and file names and in all other packets just remove payload. Antonatos Spiros ---
**Author:** ![Antonatos\_Spiros](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Antonatos\_Spiros](https://community.zeek.org/u/Antonatos_Spiros)\ **Post date:** [July 24, 2005, 9:44am UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/6 "2005-07-24T09:44:55Z")
Antonatos Spiros > From: bro-admin@ICSI.Berkeley.EDU [mailto:bro-admin@ICSI.Berkeley.EDU] On > Behalf Of Antonatos Spiros > Sent: Sunday, July 24, 2005 12:29 PM > To: rpang@cs.princeton.edu > Cc: 'Roger Winslow'; Bro@bro-ids.org; antonat@ics.forth.gr > Subject: RE: [Bro] Question on bro anonymization > > I want to make a complex policy: > First of all, in the headers I want sequential numbering to integers                                                         ^^^^^^^                                                         for the IP address and ---
**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\ **Post date:** [July 24, 2005, 3:59pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/7 "2005-07-24T15:59:24Z")
> I want to make a complex policy: > First of all, in the headers I want sequential numbering to integers and set > the TTL and IP identification number to constant values. > In case of HTTP I want to remove cookies and randomize URL. > In case of FTP randomize the user name, password and file names and in all > other packets just remove payload. In case HTTP and FTP you can follow the examples in http-rewriter.bro and ftp-anonymizer.bro. However, randomizing URL may or may not be enough for anonymization, depending on your threat model. For instance, per recent discussion with Martin Casado, Scott Crosby, and Mark Allman, we are trying to find out if combinations of content-length and last-modified-on can be used to identify pages. You are welcomed to join our discussion if you are interested. For IP header fields, Bro can sequentially number the addresses and hashes IP IDs, but it does not set TTL. To do so, you can either modify the Bro code or write a program to rewrite the TTL fields in traces anonymized by Bro. I hope it helps ... Ruoming ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/question-on-bro-anonymization/817/8 "2022-05-06T15:37:35Z")