Next: , Previous: portmapper Analyzer, Up: Analyzers and Events



7.21 The analy Analyzer

The analy analyzer provides a limited mechanism to use Bro to do statistical analysis on TCP connections. Its primary purpose is to demonstrate that Bro has applications to network traffic analysis beyond intrusion detection. It defines one event handler:

conn_stats c: connection, os: endpoint_stats, rs: endpoint_stats
Invoked for each connection when it terminates (for whatever reason). os and rs are the statistics for the originator endpoint and the responder endpoint, respectively; the table below gives the different record fields.

endpoint_stats fields for summarizing connection endpoint statistics, all of type count.

Field Meaning
num_pkts The number of packets sent by the endpoint, as seen by the monitor. The endpoint may have sent others that the network dropped upstream from the monitor.
num_rxmit The number of packets retransmitted by the endpoint, as seen by the monitor.
num_rxmit_bytes The number of bytes retransmitted by the endpoint.
num_in_order The number of packets sent by the endpoint that arrived at the monitor in order, where "in order" means in the same order as sent by the endpoint, rather than in sequence number. (Thus, a retransmission can arrive in order, by this definition.) Bro determines if the packet arrived in order by applying heuristics to the IP identification (ID) field, which in general will increase by a small amount between successive packets transmitted by an endpoint.
num_OO The number of packets sent by the endpoint that arrived at the monitor out of order. See the previous entry for the definition of "in order", and hence "out of order".
num_repl The number of extra copies of packets sent by the endpoint that arrived at the monitor. Bro considers a packet replicated if its IP ID field is the same as for the previous packet it saw from the endpoint. Using this definition, a replication is most likely caused by a network mechanism such as duplication of a packet by a router, rather than a transport mechanism such as retransmission, though some TCPs fully reuse packets when retransmitting them, including their IP ID field.
endian_type Whether the advance of the IP ID field as seen by the monitor was consistent with bigendian (network order) addition, little-endian, or undetermined. The three values are represented by the Bro constants ENDIAN_BIG, ENDIAN_LITTLE, and ENDIAN_UNKNOWN. In addition, the value can be ENDIAN_CONFUSED, meaning that the monitor saw conflicting evidence for little- and big-endian.

Table 7.7: endpoint_stats fields for summarizing connection endpoint statistics, all of type count