# Stupid scripting question: SSH password detection limited to local networks **URL:** \ **Category:** Zeek\ **Created:** [January 28, 2014, 3:08pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980 "2014-01-28T15:08:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [January 28, 2014, 3:08pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/1 "2014-01-28T15:08:40Z")
Following directions, I did: ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 28, 2014, 4:37pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/2 "2014-01-28T16:37:46Z")
Yeah, networks.cfg will be used only when running from broctl. For testing, broctl has a command "process" that processes a trace with (almost) the same configuration that it's using when running live See the corresponding entry in [http://www.bro.org/sphinx-git/components/broctl/README.html#command-reference](http://www.bro.org/sphinx-git/components/broctl/README.html#command-reference) Robin ---
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [January 28, 2014, 5:29pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/3 "2014-01-28T17:29:47Z")
Well, now I have a different problem, but the issue is somewhat tangential - unless that’s the only way for me to get Bro/broctl to tell me what it thinks my local networks are. Issue with process: It bombs out with messages like: error in /usr/local/bro-2.2/share/bro/policy/misc/loaded-scripts.bro, line 4: syntax error, at or near “module" I’m running with [BroControl] \> process /path/to/pcap /path/to/test.bro and I’ve also tried process — /path/to/test.bro process /path/to/pcap — /path/to/test.bro Poor johanna was trying to help me, and his install works just fine. So now I don’t \*know\* if I’ve got one issue, or two issues. 😉 Any ideas, Robin? Mike ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 29, 2014, 11:20pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/4 "2014-01-29T23:20:08Z")
Actually I get this too, just tried it. That looks like a bug. Here's a work-around that works for me: when you run the "process" commnand, it prints out a long command line. Copy that, leave broctl, paste it into your shell and then move your test script from its position somewhere in the middle to the very end. I don't know if this helps solving the original problem but it should tell you if broctl sets the local networks correctly. I'm also filing a ticket for this, I believe broctl should always move the the custom scripts to the end of the command line. Robin ---
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [January 29, 2014, 11:37pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/5 "2014-01-29T23:37:38Z")
> > error in /usr/local/bro-2.2/share/bro/policy/misc/loaded-scripts.bro, line 4: syntax error, at or near “module" > > Actually I get this too, just tried it. That looks like a bug. It worked for johanna as I’d originally described it. Maybe we should steal his test machine. 🙂 > Here's > a work-around that works for me: when you run the "process" commnand, > it prints out a long command line. Copy that, leave broctl, paste it > into your shell and then move your test script from its position > somewhere in the middle to the very end. > > I don't know if this helps solving the original problem but it should > tell you if broctl sets the local networks correctly. Your workaround worked for me, and did print out what I thought local networks should be set to. Justin had pointed out to me that I could use bro $PREFIX/bro/spool/installed-scripts-do-not-touch/auto/local-networks.bro test.bro which worked equally well. He also suggested a slight change to my hook: Site::is\_local\_addr(n$id$orig\_h) to Site::is\_local\_addr(n$src) and now I’m working on trying to trigger the flipping SSH password guessing logic so I can test, and not having a lot of luck. 🙂 I have a remote host I can ssh scan with impunity, so I’ve fired hydra and a simple “connect to port 22 and disconnect” script at it with no joy. I should have picked an easier notice to start with, I guess. 🙂 Mike ---
**Author:** ![Mike\_Patterson](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mike\_Patterson](https://community.zeek.org/u/Mike_Patterson)\ **Post date:** [January 30, 2014, 12:27am UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/6 "2014-01-30T00:27:40Z")
> However, if I write a test script: > ---- > @load base/utils/site > > print Site::local\_nets; > ---- > > and run “bro test.bro” output is empty unless I first redef Site::local\_nets += {}; with my ranges. > Obviously I’m doing something incorrect, but which is the most correct way to fix it? redef local\_nets in my local.bro, or have I mistaken the format of the networks.cfg file? It contains: Johanna points out that if the script is: ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/stupid-scripting-question-ssh-password-detection-limited-to-local-networks/2980/7 "2022-05-06T15:41:32Z")