analy
AnalyzerThe analy
analyzer provides a limited mechanism to
use Bro to do statistical analysis on TCP connections. Its primary
purpose is to demonstrate that Bro has applications to network
traffic analysis beyond intrusion detection. It defines one
event handler:
conn_stats c: connection, os: endpoint_stats, rs: endpoint_stats
os
and rs
are the statistics for the originator endpoint and
the responder endpoint, respectively; the table below
gives the different record fields.
endpoint_stats
fields for summarizing connection endpoint statistics,
all of type count
.
Field | Meaning
|
num_pkts | The number of packets sent by the endpoint, as seen by the monitor. The endpoint may
have sent others that the network dropped upstream from the monitor.
|
num_rxmit | The number of packets retransmitted by the endpoint, as seen by the monitor.
|
num_rxmit_bytes | The number of bytes retransmitted by the endpoint.
|
num_in_order | The number of packets sent by the endpoint that arrived at the monitor in order, where "in
order" means in the same order as sent by the endpoint, rather than in sequence number.
(Thus, a retransmission can arrive in order, by this definition.) Bro determines if the packet
arrived in order by applying heuristics to the IP identification (ID) field, which in general
will increase by a small amount between successive packets transmitted by an endpoint.
|
num_OO | The number of packets sent by the endpoint that arrived at the monitor out of order. See the
previous entry for the definition of "in order", and hence "out of order".
|
num_repl | The number of extra copies of packets sent by the endpoint that arrived at the monitor. Bro
considers a packet replicated if its IP ID field is the same as for the previous packet it saw
from the endpoint. Using this definition, a replication is most likely caused by a network
mechanism such as duplication of a packet by a router, rather than a transport mechanism
such as retransmission, though some TCPs fully reuse packets when retransmitting them,
including their IP ID field.
|
endian_type | Whether the advance of the IP ID field as seen by the monitor was consistent with bigendian
(network order) addition, little-endian, or undetermined. The three values are represented
by the Bro constants ENDIAN_BIG, ENDIAN_LITTLE, and ENDIAN_UNKNOWN.
In addition, the value can be ENDIAN_CONFUSED, meaning that the monitor saw conflicting
evidence for little- and big-endian.
|
Table 7.7: endpoint_stats
fields for summarizing connection endpoint statistics, all of type count