Re: MAC Address In Logs
Michael Shirk <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAL8PkUWj4rym0tOJc5E8koDWyLuUFOvnWuoZZkSry8ZdU=iYcQ@mail.gmail.com> |
You need to add the following to your local.bro script to enable it, as it is not on by default: @load policy/protocols/conn/mac-logging On Tue, Feb 19, 2019 at 2:07 AM TQ <[email protected]> wrote: > > Is there a way to include MAC address in all of the logs or custom written logs? I saw the documentation (https://docs.zeek.org/en/latest/scripts/policy/protocols/conn/mac-logging.bro.html), but didn't see any MAC addresses even though I could see them in Wireshark. > > Thanks, > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek -- Michael Shirk Daemon Security, Inc. https://www.daemon-security.com _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek