signature match script

Zeek
1

Hi guys, I'm new on Bro scripts. I'm traying to test the most easiest signature match script. I have read the manual and some examples, but it is not working.

So I tried the following:
on signatura.sig:

signature my-first-sig {
ip-proto == tcp
dst-port == 12345
payload /.*hello/
event "Signature Found"
}

on test_sig.bro (was added on local.bro):

@load base/frameworks/notice
@load base/frameworks/signatures/main
@load-sigs ./signatura.sig #in the same directory

event signature_match(state: signature_state, msg: string, data: string)
{
print fmt("Match!!! %s",msg);
print fmt("%s",data);
}

event tcp_packet (c: connection, is_orig: bool, flags: string, seq: count, ack: count, len: count, payload: string)
{
print fmt ("%s",payload);
}

So I create a socket to connect the host and send messages just to test it.
When i run the program
bro -i eth0 local # the interface is the correct one
I can see the payload of the tcp packets (the messages I'm sending) but I don't have any type of signature.log not even the print Im doing.
What could be happening?
Thanks

-- Martin

2

Hi guys, I'm new on Bro scripts. I'm traying to test the most easiest
signature match script. I have read the manual and some examples, but it
is not working.

So I tried the following:
on signatura.sig:

signature my-first-sig {
ip-proto == tcp
dst-port == 12345
payload /.*hello/
event "Signature Found"
}

on test_sig.bro (was added on local.bro):

@load base/frameworks/notice
@load base/frameworks/signatures/main
@load-sigs ./signatura.sig #in the same directory

event signature_match(state: signature_state, msg: string, data: string)
{
print fmt("Match!!! %s",msg);
print fmt("%s",data);
}

event tcp_packet (c: connection, is_orig: bool, flags: string, seq:
count, ack: count, len: count, payload: string)
{
print fmt ("%s",payload);
}

So I create a socket to connect the host and send messages just to test it.
When i run the program
bro -i eth0 local # the interface is the correct one
I can see the payload of the tcp packets (the messages I'm sending) but
I don't have any type of signature.log not even the print Im doing.
What could be happening?
Thanks

-- Martin

3

Martin,
The .sig file looks fine. I don't load those in local.bro, I load them in
<BRO_DIR_>/base/frameworks/signatures/main.bro. I have my sigs in that
directory as well.

Patrick Powell
Security Analyst
21CT, Inc.
Direct: 512.682.4754
Cell: 210.587.9255
Direct Fax: 512.682.4749

4

IT must be something else, I tryied what you said Patrick but is still not working.
May be something in configuration I should switch on?