tag:blogger.com,1999:blog-7652481.post8803772427154600264..comments2009-06-08T08:05:42.892-04:00David Biancohttp://www.blogger.com/profile/09760835714791462863noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-7652481.post-5171323257537124812008-11-06T14:42:51.898-05:002008-11-06T14:42:51.898-05:00Seth, thanks for the great tips! I took all your suggestions, and have uploaded a new, more concise, version. As a bonus, I hooked into just a single event this time, the new_connection event, so the script now works for ICMP and anything else Bro detects.David Biancohttp://www.blogger.com/profile/09760835714791462863noreply@blogger.comtag:blogger.com,1999:blog-7652481.post-78213877663294886452008-11-03T23:14:36.301-05:002008-11-03T23:14:36.301-05:00Hi David, thanks for writing this script. I've found that some of the small scripts like will tend to be some of the most incredibly useful scripts you use.<BR/><BR/>To make the script a little nicer, you could change it to only throw a single notice: "UnexpectedOutgoingConnection". You could reduce the check_restricted_outgoing_tcp and check_restricted_outgoing_udp functions into just check_restricted_outgoing since the code for those two is almost completely duplicate and the protocol information would still be contained when you throw the notice because you're attaching the actual connection record. If you're still interesting in including the protocol type in the message of the notice, you can get the protocol type with the <BR/>get_conn_transport_proto function (e.g. get_conn_transport_proto(c$id) )<BR/><BR/>It looks like you could probably remove the "const CONN_ATTEMPTED", etc. definitions from the beginning too, those don't seem to be used for anything. Other than those little things, I don't see anything else worth pointing out. <BR/><BR/>It's a nice script, I might start down this path too. In my environment it's somewhat difficult to determine what hosts should and shouldn't be doing certain activities but that's no reason not to give it a try.Seth Hallhttp://www.blogger.com/profile/12496449784833418201noreply@blogger.com