# Snort 2 Bro Utility

**URL:** <https://community.zeek.org/t/snort-2-bro-utility/5239>\
**Category:** Zeek\
**Created:** [April 2, 2018, 6:43am UTC](https://community.zeek.org/t/snort-2-bro-utility/5239 "2018-04-02T06:43:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahul\_rakesh](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@rahul\_rakesh](https://community.zeek.org/u/rahul_rakesh)\
**Post date:** [April 2, 2018, 6:43am UTC](https://community.zeek.org/t/snort-2-bro-utility/5239/1 "2018-04-02T06:43:40Z")

</div>

Dear Team,

Can anyone please share snort2bro utility as i just wanted to know how the conversion is done. It will help me writing signatures.

Regards,

Rahul

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [April 2, 2018, 1:43pm UTC](https://community.zeek.org/t/snort-2-bro-utility/5239/2 "2018-04-02T13:43:27Z")

</div>

Rahul,

That utility has been long deprecated, largely due to difference in approach by Snort and Bro.

I’ll share the demo signature below. As always, feel free to reach out directly, should you need.

```auto
signature my-first-sig {
    ip-proto == tcp
    dst-port == 80
    payload /.*root/
    event "Found root!"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/snort-2-bro-utility/5239/3 "2022-05-06T15:45:40Z")

</div>