Using snort2bro

Zeek
1

Hi, i can’t use snort2bro.
I follow the wiky instruction (http://www.bro-ids.org/wiki/index.php/Reference_Manual:_Signatures#snort2bro) but it say: snort2bro command not found.
I know that it has to be already installed with bro, but if i give “locate snort2bro”, i can’t find it.

How can i use it?

thanks
Paolo Tironi

2

i’ve just resolved the problem.
Now i understand how to use s2b and i’ve just convert a snort rule in a bro policy. I redirected the stdout to a file .bro. The result is a file with many row of code, but i can’t use it as a bro policy (error: unknown idetifier signature, at or near “signature”).
The structure of the file is:

signature 549-8 {
ip-proto == tcp
src-ip == local_nets
dst-ip != local_nets
dst-port == 8888
tcp-state established,originator
event “P2P napster login”
payload /.*\x00\x02\x00/
}

this is not equal to a classic bro policy.
How can i use it to create my own policy?

Thaks

Paolo Tironi

2008/7/17 Paolo Tironi <paolo.tironi85@gmail.com>:

3

Hi Paolo,

signature 549-8 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == 8888
  tcp-state established,originator
  event "P2P napster login"
  payload /.*\x00\x02\x00/
  }

this is not equal to a classic bro policy.
How can i use it to create my own policy?

   You can write your own Bro policy script which defines a
   signature_match event handler for signatures to catch specifically
   this signature on your own (the signature_match event is triggered
   for every signatures mathing but it receives a signature_state
   parameter which contains the id of the signature being matched. In
   you case it'd be 549-8).

   Alternatively, just uncomment brolite-sigs (i.e., @load it) in your
   host file generated when Bro was installed (it's usually in
   site/<hostname>.bro). I suggest you to read brolite-sigs.bro as well
   as you may also want to redefine signature_files to include your own
   signature file.

   Also, take a look at
   http://www.bro-ids.org/wiki/index.php/Reference_Manual:_Signatures

bye,
Lorenzo