# Questions

**URL:** <https://community.zeek.org/t/questions/662>\
**Category:** Zeek\
**Created:** [December 24, 2004, 12:24pm UTC](https://community.zeek.org/t/questions/662 "2004-12-24T12:24:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christoph\_Goeldi](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Christoph\_Goeldi](https://community.zeek.org/u/Christoph_Goeldi)\
**Post date:** [December 24, 2004, 12:24pm UTC](https://community.zeek.org/t/questions/662/1 "2004-12-24T12:24:15Z")

</div>

hi

i'm currently working on my masterthesis here at the swiss federal institute of technology in zurich.  
it's about "scan detection based identification of worm-infected hosts"  
in small LANs.  
now, i'm evaluating bro and try to use it for my purposes.  
i'm currently using bro 0.9a7 on a linux pc and i'm trying to implement  
some existing scan detection approaches.

here my questions:  
- i'm not quite sure about the future plans of bro. will there be  
a lot of big changes from now to the release of 1.0? incompatibilities?

- there exists a detection method which is based on the entropy of  
ip headers (tuple: src, dst, src\_port, dst\_port). the algorithm stores this table of tuples every minute in a file and compresses it using  
the LZO-compression-algorithm. then the size of the file is an indicator  
for network anomalies.  
now my question: how can i best implement this with bro? how can i use  
the lzo-algorithm (which is available in C, java, perl...) to compress  
my file every minute and get back the resulting file size?

thanx  
christoph

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/questions/662/2 "2022-05-06T15:37:18Z")

</div>