Next: , Previous: ftpbro, Up: Predefined Variables



6.1.13 hot.bro

same_local_net_is_spoof : bool
If true (default = F), it should be considered a spoofing attack if a connection has the same local net for source and destination.
Note: This variable is const, so may only be changed via redef.

allow_spoof_services : set[port]

The services in this set are not counted as spoofed even if they pass the test from same_local_net_is_spoof.
Note: This variable is const, so may only be changed via redef.

allow_pairs : set[addr, addr]

Connections between these (source address, destination address) pairs are never marked as “hot”.
Note: This variable is const, so may only be changed via redef.

allow_16_net_pairs : set[addr, addr]

Connections between these (/16 network, /32 destination host) pairs are never marked as “hot”.
Note: This variable is const, so may only be changed via redef.

hot_srcs : table[addr] of string

Connections from any of these sources are automatically marked “hot” with the associated message in the table.
Note: This variable is const, so may only be changed via redef.

hot_dsts : table[addr] of string

Connections to any of these destinations are automatically marked “hot” with the associated message in the table.
Note: This variable is const, so may only be changed via redef.

hot_src_24nets : table[addr] of string

Connections from any of these source /24 nets are automatically marked “hot” with the associated message in the table.
Note: This variable is const, so may only be changed via redef.

hot_dst_24nets : table[addr] of string

Connections to any of these destination /24 nets are automatically marked “hot” with the associated message in the table.
Note: This variable is const, so may only be changed via redef.

allow_services : set[port]

Connections to this set of services are never marked “hot” (based on port number).
Note: This variable is const, so may only be changed via redef.

allow_services_to : set[addr, port]

Connections to the specified host and port are never marked “hot”.
Note: This variable is const, so may only be changed via redef.

allow_service_pairs : set[addr, addr, port]

Connections from the first address to the second on the specified destination port are never marked “hot”.
Note: This variable is const, so may only be changed via redef.

flag_successful_service : table[port] of string

Successful connections to any of the specified ports are flagged with the accompanying message. Examples are popular backdoor ports.
Note: This variable is const, so may only be changed via redef.

flag_successful_inbound_service : table[port] of string

Incoming connections to the specified ports are flagged with the accompanying message. This is similar to , but may be used when the port gives to many false positives for outgoing connections.
Note: This variable is const, so may only be changed via redef.

terminate_successful_inbound_service : table[port] of string

Connections to this port, if previously flagged by flag_successful_service or flag_incoming_service are terminated.
Note: This variable is const, so may only be changed via redef.

flag_rejected_service : table[port] of string

Failed connection attempts to the specified ports are marked as “hot”.
Note: This variable is const, so may only be changed via redef.