The demux Module
Keywords: doc-html

Next: The dns Module Up: Analyzers and Events Previous: The active Module Contents Index

#
The `demux` Module

The `demux` utility module provides a single function:

  [``demux_conn`(id: conn_id, tag: string, otag: string, rtag: string): bool``` ] Instructs Bro to write (``demultiplex'') the contents of the connection with the given `id` to a pair of files whose names are constructed out of `tag`, `otag`, and `rtag`, as follows.

  The originator-to-responder direction of the connection goes into a file named:

  > `<`otag`>.<` tag`>.<` orig-addr`>.<` orig-port`>-<` resp-addr`>.<` resp-port`>`

  and the other direction in:

  > `<`rtag`>.<` tag`>.<` resp-addr`>.<` resp-port`>-<` orig-addr`>.<` orig-port`>`

  Accordingly, tag can be used to associate a unique label with the pair of files, while otag and rtag provide distinct labels for the two directions.

  If Bro is already demuxing the connection, or if the connection is not active, then nothing happens, and the function returns false. Otherwise, it returns true.

Bro places demuxed streams in a directory defined by the redefinable global `demux_dir`, which defaults in the usual fashion to `open_log_file("xscript")`.

Deficiency: Experience has shown that it would be highly convenient if Bro would demultiplex the entire connection contents into the files, instead of just the part of the connection seen subsequently after the call to `demux_conn`. One way to do this would be for `demux_conn` to offset the contents in the file by the current stream position, and then to invoke a utility tool that goes through the Bro output trace file (§ ) and copies the contents up to the current stream position to the front of the file. This utility tool might even be another instance of Bro running with suitable arguments.

Next: The dns Module Up: Analyzers and Events Previous: The active Module Contents Index