ignore_checksums : bool
If T (default = F), packet checksums are not verified.
Note: This variable isconst
, so may only be changed viaredef
.
partial_connection_ok : bool
If T (the default), instantiate connection state when a partial connection (one missing its initial establishment negotiation) is seen.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_SYN_ack_ok : bool
If T (the default), instantiate connection state when a SYN ack is seen but not the initial SYN (even if partial_connection_ok is false).
Note: This variable isconst
, so may only be changed viaredef
.
tcp_match_undelivered : bool
If a connection state is removed there may still be some undelivered data waiting in the reassembler. If T (the default), pass this to the signature engine before flushing the state.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_SYN_timeout : interval
Check up on the result of an initial SYN after this much time. Fixme: What exactly does this mean? Check that the connection is active?
Note: This variable isconst
, so may only be changed viaredef
.
tcp_session_timer : interval
After a connection has closed, wait this long for further activity before checking whether to time out its state.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_connection_linger : interval
When checking a closed connection for further activity, consider it inactive if there hasn't been any for this long. Complain if the connection is reused before this much time has elapsed.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_attempt_delayv : interval
Wait this long upon seeing an initial SYN before timing out the connection attempt.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_close_delay : interval
Upon seeing a normal connection close, flush state after this much time.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_reset_delay : interval
Upon seeing a RST, flush state after this much time.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_partial_close_delay : interval
Generate a connection_partial_close event this much time after one half of a partial connection closes, assuming there has been no subsequent activity.
Note: This variable isconst
, so may only be changed viaredef
.
non_analyzed_lifetime : interval
If a connection belongs to an application that we don't analyze, time it out after this interval. If 0 secs, then don't time it out.
Note: This variable isconst
, so may only be changed viaredef
.
inactivity_timeout : interval
If a connection is inactive, time it out after this interval. If 0 secs, then don't time it out.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_storm_thresh : count
This many FINs/RSTs in a row constitutes a "storm". See alsotcp_storm_interarrival_thresh
.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_storm_interarrival_thresh : interval
The FINs/RSTs must come with this much time or less between them to be considered a storm. See alsotcp_storm_thresh
.
Note: This variable isconst
, so may only be changed viaredef
.
tcp_reassembler_ports_orig : set[port]
For services without a handler, these sets define which side of a connection is to be reassembled. Fixme: What is the point of this exactly? What are you analyzing?
Note: This variable isconst
, so may only be changed viaredef
.
tcp_reassembler_ports_resp : set[port]
For services without a handler, these sets define which side of a connection is to be reassembled. Fixme: What is the point of this exactly? What are you analyzing?
Note: This variable isconst
, so may only be changed viaredef
.
table_expire_interval : interval
Check for expired table entries after this amount of time Fixme: Which tables?
Note: This variable isconst
, so may only be changed viaredef
.
dns_session_timeout : interval
Time to wait before timing out a DNS request.
Note: This variable isconst
, so may only be changed viaredef
.
ntp_session_timeout : interval
Time to wait before timing out an NTP request.
Note: This variable isconst
, so may only be changed viaredef
.
rpc_timeout : interval
Time to wait before timing out an RPC request.
Note: This variable isconst
, so may only be changed viaredef
.
watchdog_interval : interval
A SIGALRM is set for this interval to make sure that Bro does not get caught up doing something for too long. Fixme: True? If this happens, Bro is termination after doing a dump of all remaining packets.
Note: This variable isconst
, so may only be changed viaredef
.
heartbeat_interval : interval
After each interval of this length, update the variable.
Note: This variable isconst
, so may only be changed viaredef
.
anonymize_ip_addr : bool
If true (default = false), then IP addresses are anonymized in alert and log generation.
Note: This variable isconst
, so may only be changed viaredef
.
omit_rewrite_place_holder : bool
If true, omit place holder packets when rewriting. Fixme: Should this go somewhere else?
Note: This variable isconst
, so may only be changed viaredef
.
rewriting_http_trace : bool
If true (default = F), HTTP traces are rewritten.
Note: This variable isconst
, so may only be changed viaredef
.
rewriting_smtp_trace : bool
If true (default = F), SMTP traces are rewritten.
Note: This variable isconst
, so may only be changed viaredef
.