Ticket #25 (seen Feature Request)

Opened 3 years ago

Last modified 3 years ago

TRW should be more flexible in determining what connections to skip

Reported by: vern Owned by:
Priority: Normal Milestone:
Component: Bro Version:
Keywords: Cc:

Description

[From Eric Thomas, Sandia]

Instead of using a set lookup (the honeypot global) to determine whether
a connection is related to a honeypot, introduce a function variable that
gets set to a function which takes a connection record as input and returns
a boolean. The return value specifies T/F whether the connection is
associated with a honeypot. This function is called in check_TRW_scan
(trw-impl.bro) instead of the set lookup in honeypot.

The default function would do the simple set lookup, as is done now. But it
allows others to create a function that performs more complex operations.

Change History

comment:1 Changed 3 years ago by robin

  • Status changed from new to seen
Note: See TracTickets for help on using tickets.