[
https://bro-tracker.atlassian.net/browse/BIT-1090?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14214#comment-14214
]
AK commented on BIT-1090:
-------------------------
Running your scripts against Bro version 2.1-1150 I get this
error in ./my-detect-bruteforcing.bro, line 5: can't open
base/frameworks/metrics
Try upgrading to the latest version of Bro, modifying the
detect-bruteforcing.bro script it installs and loading it with your
sigsup-ssh-pass2.bro script.
> fatal error Val::CONVERTER
> --------------------------
>
> Key: BIT-1090
> URL: https://bro-tracker.atlassian.net/browse/BIT-1090
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: 2.1
> Environment: Ubuntu 10.04.03 LTS, bro 2.1-179
> Reporter: tyler.schoenke
> Attachments: my-detect-bruteforcing.bro, sigsup-ssh-pass2.bro
>
>
> Hi guys,
> I get the following message when I modified a data structure in
> detect-bruteforcing.bro. I didn't get a chance to test against the current
> version, but did a quick check against the mailing lists and tracker and
> didn't see this issue mentioned.
> $ bro my-detect-bruteforcing.bro sigsup-ssh-pass2.bro
> fatal error in ./sigsup-ssh-pass2.bro, line 2: Val::CONVERTER (types/table)
> (10.0.0.1/32)
> Here is the modification to detect-bruteforcing.bro:
> const ignore_guessers: table[subnet] of set[subnet] = {} &redef;
> I found the need to whitelist from a single host to multiple subnets instead
> of a single subnet. The following minimal script will produce the error.
> cat sigsup-ssh-pass2.bro
> redef SSH::ignore_guessers = {
> [172.0.0.0/16] = set( 10.0.0.1/32 )
> };
> Any help would be appreciated.
> Thanks,
> Tyler
--
This message was sent by Atlassian JIRA
(v6.1-OD-09-WN#6144)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
