Node: Tuning Scan Detection, Next: , Previous: Signatures, Up: Customizing Bro



Tuning Scan Detection

There are a large number of tunable parameters in the scan analyzer, all of which are described in the reference manual. Most of these parameters should be fine for all sites. The only settings that you may want to tune are:

If you want enable ICMP scan detection, set these:

     redef ICMP::detect_scans = T;
     redef ICMP::scan_threshold = 100;