The site analyzer is not actually an analyzer but simply a set of global variables (and one function) used to define a site's basic topological information.
The site module defines the following variables, all redefinable:
Default: empty.
[local_16_nets : set[net]] Defines which /16 prefixes Bro should consider as reflecting a local address. Deficiency: Bro currently is inconsistent regarding when it consults local_nets versus local_16_nets, so you should ensure that this variable and the previous one are always consistent.
Default: empty.
[local_24_nets : set[net]] The same, but for /24 addresses.
Default: empty.
[neighbor_nets : set[net]] Defines which net's Bro should consider as reflecting a ``neighbor.'' Neighbors networks can be treated specially in some policies, distinct from other non-local addresses. In particular, drop_address will not drop connectivity to an address belonging to a neighbor.
The notion is somewhat historical, as
is the use of ``U'' to mark neighbors in connection summaries
(§
Default: empty.
[neighbor_16_nets : set[addr]]
Defines which /16 addresses Bro should consider as reflecting a neighbor;
the only use of this variable in the standard scripts is that a scan
originating from an address with one of these prefixes will not be dropped
(§
Default: empty.
[neighbor_24_nets : set[net]] The same, but for /24 addresses.
Default: empty.
Currently, the site module only defines one function: