Analyzers and Events
Keywords: doc-html

Next: Activating an Analyzer Up: The Bro 0.8 User Previous: Predefined Functions Contents Index

#
Analyzers and Events

In this chapter we detail the different analyzers that Bro provides. Some analyzers look at traffic in fairly generic terms, such as at the level of TCP or UDP connections. Others delve into the specifics of a particular application that is carried on top of TCP or UDP.

As we use the term here, analyzer primarily refers to Bro's event engine. We use the term script to refer to a set of event handlers (and related functions and variables) written in the Bro language; module to refer to a script that serves primarily to provide utility (helper) functions and variables, rather than event handlers; and handler to denote an event handler written in the Bro language. Furthermore, the standard script is the script that comes with the Bro distribution for handling the events generated by a particular analyzer.

Note: However, we also sometimes use analyzer to refer to the event handler that processes events generated by the event engine.

We characterize the analyzers in terms of what events they generate, but don't here go into the details of how they generate the events (i.e., the nitty gritty C++ implementations of the analyzers).

Subsections

- Activating an Analyzer
  - Loading Analyzers
  - Filtering
- General Processing Events
- Generic Connection Analysis
  - The `connection` record
  - Definitions of connections
  - Generic TCP connection events
  - The `tcp` analyzer
  - The `udp` analyzer
  - Connection summaries
  - Connection functions
- Site-specific information
  - Site variables
  - Site-specific functions
- The `hot` Analyzer
  - `hot` variables
  - `hot` functions
- The `scan` Analyzer
  - `scan` variables
  - `scan` functions
  - `scan` event handlers
- The `port-name` Module
- The `mt` Module
- The `log` Module
- The `active` Module
- The `demux` Module
- The `dns` Module
  - The `dns_mapping` record
  - `dns` variables
  - `dns` event handlers
- The `finger` Analyzer
  - `finger` variables
  - `finger` event handlers
- The `frag` Module
- The `hot-ids` Module
- The `ftp` Analyzer
  - The `ftp_session_info` record
  - `ftp` variables
  - `ftp` functions
  - `ftp` event handlers
- The `http` Analyzer
  - `http` variables
  - `http` event handlers
- The `ident` Analyzer
  - `ident` variables
  - `ident` event handlers
- The `login` Analyzer
  - `login` analyzer confusion
  - `login` variables
  - `login` functions
  - `login` event handlers
- The `portmapper` Analyzer
  - `portmapper` variables
  - `portmapper` functions
  - `portmapper` event handlers
- The `analy` Analyzer
- The `weird` Module
  - Actions for ``weird'' events
  - `weird` variables
  - `weird` functions
  - Events handled by `conn_weird`
  - Events handled by `conn_weird_addl`
  - Events handled by `flow_weird`
  - Events handled by `net_weird`
  - Events generated by the standard scripts
  - Additional handlers for ``weird'' events
- The `icmp` Analyzer
- The `stepping` Analyzer
- The `ssh-stepping` Module
- The `backdoor` Analyzer
- The `interconn` Analyzer

Next: Activating an Analyzer Up: The Bro 0.8 User Previous: Predefined Functions Contents Index