signarture dst-port issue

Zeek
1

Hello,

I am having trouble using signatures on bro. Lets say we have the following signature

signature s2b-99999-9 {
  ip-proto == tcp
  #dst-port == 80
  #dst-port == http_ports
  tcp-state established
  event "Sample Signature"
}

when I using "dst-port == 80" everything goes seems to work. By 'work' I mean that bro generates plenty of warnings placing them on signatures.log, however, if we replace "st-port == 80" for "dst-port == http_ports" and throw it again against the same trace, we no longer get any warnings.

http_ports is declared on $BROPATH/policy/snort.bro as:
const http_ports = { 80/tcp, 8000/tcp, 8001/tcp, 8080/tcp };

I assume snort..bro is loaded correctly since otherwise throws non-declaration errors. It is loaded it on my hostname.bro file which I use when running bro.

Also, does anybody know whether next release will implement other regular expression matching library? I am trying to update snort2bro to support the snort pcre, however it is not a trivial task.

Any suggestions?
Thank you!
Miguel

2

I am having trouble using signatures on bro. Lets say we have the following signature

Can you send me a small trace with which you see the problem and the
exect command line you're using to start Bro?

Also, does anybody know whether next release will implement other
regular expression matching library?

No, we don't have any plans to switch to another regexp library.

I am trying to update snort2bro to support the snort pcre, however
it is not a trivial task.

Cool! but yeah, not exactly trivial. :slight_smile:

Robin