How to configure bro to listen locally instead of on all interfaces?
By default, bro listens on port 47660, that is okay, but I cannot seem to find any option to tell it to only listen on a particular IP or interface. Is that possible?
I checked here:
https://github.com/bro/broctl/blob/master/etc/node.cfg
https://www.bro.org/sphinx/components/broctl/README.html
networking configuration network-interface ip-address bro
edited 1 hour ago
Jeff Schaller
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
add a comment |
By default, bro listens on port 47660, that is okay, but I cannot seem to find any option to tell it to only listen on a particular IP or interface. Is that possible?
I checked here:
https://github.com/bro/broctl/blob/master/etc/node.cfg
https://www.bro.org/sphinx/components/broctl/README.html
networking configuration network-interface ip-address bro
edited 1 hour ago
Jeff Schaller
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
add a comment |
By default, bro listens on port 47660, that is okay, but I cannot seem to find any option to tell it to only listen on a particular IP or interface. Is that possible?
I checked here:
https://github.com/bro/broctl/blob/master/etc/node.cfg
https://www.bro.org/sphinx/components/broctl/README.html
networking configuration network-interface ip-address bro
edited 1 hour ago
Jeff Schaller
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
By default, bro listens on port 47660, that is okay, but I cannot seem to find any option to tell it to only listen on a particular IP or interface. Is that possible?
I checked here:
https://github.com/bro/broctl/blob/master/etc/node.cfg
https://www.bro.org/sphinx/components/broctl/README.html
networking configuration network-interface ip-address bro
networking configuration network-interface ip-address bro
edited 1 hour ago
Jeff Schaller
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
edited 1 hour ago
Jeff Schaller
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
edited 1 hour ago
Jeff Schaller
43.4k1160140
edited 1 hour ago
Jeff Schaller
43.4k1160140
edited 1 hour ago
Jeff Schaller
43.4k1160140
43.4k1160140
asked Mar 9 '18 at 5:25
WalterWalter
5372619
asked Mar 9 '18 at 5:25
WalterWalter
5372619
asked Mar 9 '18 at 5:25
WalterWalter
5372619
5372619
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
According to the Quick Start guide, edit the interface option in $PREFIX/etc/node.cfg. The full list of options that you can change in this file are found in the Node plugin documentation.
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
add a comment |
According to https://www.bro.org/sphinx/scripts/base/frameworks/communication/main.bro.html, the variable to set is Communication::listen_interface in base/frameworks/communication/main.bro (or possibly in your node.cfg, but I can't figure out how to do that).
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f429166%2fhow-to-configure-bro-to-listen-locally-instead-of-on-all-interfaces%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
According to the Quick Start guide, edit the interface option in $PREFIX/etc/node.cfg. The full list of options that you can change in this file are found in the Node plugin documentation.
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
add a comment |
According to the Quick Start guide, edit the interface option in $PREFIX/etc/node.cfg. The full list of options that you can change in this file are found in the Node plugin documentation.
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
add a comment |
According to the Quick Start guide, edit the interface option in $PREFIX/etc/node.cfg. The full list of options that you can change in this file are found in the Node plugin documentation.
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
According to the Quick Start guide, edit the interface option in $PREFIX/etc/node.cfg. The full list of options that you can change in this file are found in the Node plugin documentation.
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
answered Mar 9 '18 at 6:18
ErikFErikF
2,9411513
2,9411513
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
add a comment |
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
Thanks, but I was following that and don't see anything specific about controlling anything other than the port: bro.org/sphinx/components/broctl/README.html#class-node
– Walter
Mar 9 '18 at 12:18
add a comment |
According to https://www.bro.org/sphinx/scripts/base/frameworks/communication/main.bro.html, the variable to set is Communication::listen_interface in base/frameworks/communication/main.bro (or possibly in your node.cfg, but I can't figure out how to do that).
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
add a comment |
According to https://www.bro.org/sphinx/scripts/base/frameworks/communication/main.bro.html, the variable to set is Communication::listen_interface in base/frameworks/communication/main.bro (or possibly in your node.cfg, but I can't figure out how to do that).
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
add a comment |
According to https://www.bro.org/sphinx/scripts/base/frameworks/communication/main.bro.html, the variable to set is Communication::listen_interface in base/frameworks/communication/main.bro (or possibly in your node.cfg, but I can't figure out how to do that).
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
According to https://www.bro.org/sphinx/scripts/base/frameworks/communication/main.bro.html, the variable to set is Communication::listen_interface in base/frameworks/communication/main.bro (or possibly in your node.cfg, but I can't figure out how to do that).
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
answered Nov 16 '18 at 4:53
Ben SternBen Stern
1837
1837
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f429166%2fhow-to-configure-bro-to-listen-locally-instead-of-on-all-interfaces%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
