Bro provides the following events relating to its overall processing:
bro_init ()
net_done (t: time)
t
gives the time at which network processing
finished.
This event is generated before bro_done
. Note: If Bro
terminates due to an invocation of exit
, then this event is
not generated.
bro_done ()
This event is generated after net_done
. If you have cleanup
that only needs to be done when processing network traffic, it likely is
better done using net_done
. Note: If Bro terminates due to an
invocation of exit
, then this event is not generated.
bro_signal (signal: count)
Receiving either of the first two terminates Bro, though if Bro is in the
middle of processing a set of events, it first finishes with them before
shutting down. The shutdown leads to invocations of net_done
and bro_done
, in that order. Deficiency: In this case, Bro fails to invoke bro_signal
, clearly a bug.
Upon receiving SIGHUP, Bro invokes flush_all
(in addition
to your handler, if any).
net_stats_update (t: time, ns: net_stats)
t
, the time
at which
the event was generated, and ns
, a net_stats
record,
as defined in the example below.
Regarding this second parameter,
the pkts_recvd
field gives the total number of packets accepted
by the packet filter so far during this execution of Bro; pkts_dropped
gives the total number of packets reported dropped by the kernel;
and interface_drops
gives the total number of packets reported
by the kernel as having been dropped by the network interface.
Note: An important consideration is that, as shown by experience, the
kernel's reporting of these statistics is not always accurate.
In particular, the $pkts_dropped
statistic is sometimes missing actual packet drops, and some operating
systems do not support the interface_drops
statistic at all.
See the ack_above_hole
event for an alternate
way to detect if packets are being dropped.
type net_stats: record { # All counts are cumulative. pkts_recvd: count; # Number of packets received so far. pkts_dropped: count; # Number of packets *reported* dropped. interface_drops: count; # Number of drops reported by interface(s). };