7.5.1 Site variables

The site module defines the following variables, all redefinable:

local_nets set[net]

Defines which net's Bro should consider as reflecting a local address.

Default: empty.

local_16_nets set[net]

Defines which /16 prefixes Bro should consider as reflecting a local address. Deficiency:Bro currently is inconsistent regarding when it consults local_nets versus local_16_nets, so you should ensure that this variable and the previous one are always consistent.

Default: empty.

local_24_nets set[net]

The same, but for /24 addresses.

Default: empty.

neighbor_nets set[net]

Defines which net's Bro should consider as reflecting a “neighbor.” Neighbors networks can be treated specially in some policies, distinct from other non-local addresses. In particular, will not drop connectivity to an address belonging to a neighbor.

The notion is somewhat historical, as is the use of “U” to mark neighbors in connection summaries (See Connection summaries).

Default: empty.

neighbor_16_nets set[addr]

Defines which /16 addresses Bro should consider as reflecting a neighbor; the only use of this variable in the standard scripts is that a scan originating from an address with one of these prefixes will not be dropped . Deficiency:The name is poorly chosen and should be changed to better reflect this use. Deficiency:In addition, this variable should be kept consistent with neighbor_nets, until the fine day when the processing is rectified to only use one variable.

Default: empty.

neighbor_24_nets set[net]

The same, but for /24 addresses.

Default: empty.