Next: , Previous: backdoorbro, Up: Predefined Variables



6.1.5 bro.init

ignore_checksums : bool
If T (default = F), packet checksums are not verified.
Note: This variable is const, so may only be changed via redef.

partial_connection_ok : bool

If T (the default), instantiate connection state when a partial connection (one missing its initial establishment negotiation) is seen.
Note: This variable is const, so may only be changed via redef.

tcp_SYN_ack_ok : bool

If T (the default), instantiate connection state when a SYN ack is seen but not the initial SYN (even if partial_connection_ok is false).
Note: This variable is const, so may only be changed via redef.

tcp_match_undelivered : bool

If a connection state is removed there may still be some undelivered data waiting in the reassembler. If T (the default), pass this to the signature engine before flushing the state.
Note: This variable is const, so may only be changed via redef.

tcp_SYN_timeout : interval

Check up on the result of an initial SYN after this much time. Fixme: What exactly does this mean? Check that the connection is active?
Note: This variable is const, so may only be changed via redef.

tcp_session_timer : interval

After a connection has closed, wait this long for further activity before checking whether to time out its state.
Note: This variable is const, so may only be changed via redef.

tcp_connection_linger : interval

When checking a closed connection for further activity, consider it inactive if there hasn't been any for this long. Complain if the connection is reused before this much time has elapsed.
Note: This variable is const, so may only be changed via redef.

tcp_attempt_delayv : interval

Wait this long upon seeing an initial SYN before timing out the connection attempt.
Note: This variable is const, so may only be changed via redef.

tcp_close_delay : interval

Upon seeing a normal connection close, flush state after this much time.
Note: This variable is const, so may only be changed via redef.

tcp_reset_delay : interval

Upon seeing a RST, flush state after this much time.
Note: This variable is const, so may only be changed via redef.

tcp_partial_close_delay : interval

Generate a connection_partial_close event this much time after one half of a partial connection closes, assuming there has been no subsequent activity.
Note: This variable is const, so may only be changed via redef.

non_analyzed_lifetime : interval

If a connection belongs to an application that we don't analyze, time it out after this interval. If 0 secs, then don't time it out.
Note: This variable is const, so may only be changed via redef.

inactivity_timeout : interval

If a connection is inactive, time it out after this interval. If 0 secs, then don't time it out.
Note: This variable is const, so may only be changed via redef.

tcp_storm_thresh : count

This many FINs/RSTs in a row constitutes a "storm". See also tcp_storm_interarrival_thresh.
Note: This variable is const, so may only be changed via redef.

tcp_storm_interarrival_thresh : interval

The FINs/RSTs must come with this much time or less between them to be considered a storm. See also tcp_storm_thresh.
Note: This variable is const, so may only be changed via redef.

tcp_reassembler_ports_orig : set[port]

For services without a handler, these sets define which side of a connection is to be reassembled. Fixme: What is the point of this exactly? What are you analyzing?
Note: This variable is const, so may only be changed via redef.

tcp_reassembler_ports_resp : set[port]

For services without a handler, these sets define which side of a connection is to be reassembled. Fixme: What is the point of this exactly? What are you analyzing?
Note: This variable is const, so may only be changed via redef.

table_expire_interval : interval

Check for expired table entries after this amount of time Fixme: Which tables?
Note: This variable is const, so may only be changed via redef.

dns_session_timeout : interval

Time to wait before timing out a DNS request.
Note: This variable is const, so may only be changed via redef.

ntp_session_timeout : interval

Time to wait before timing out an NTP request.
Note: This variable is const, so may only be changed via redef.

rpc_timeout : interval

Time to wait before timing out an RPC request.
Note: This variable is const, so may only be changed via redef.

watchdog_interval : interval

A SIGALRM is set for this interval to make sure that Bro does not get caught up doing something for too long. Fixme: True? If this happens, Bro is termination after doing a dump of all remaining packets.
Note: This variable is const, so may only be changed via redef.

heartbeat_interval : interval

After each interval of this length, update the variable.
Note: This variable is const, so may only be changed via redef.

anonymize_ip_addr : bool

If true (default = false), then IP addresses are anonymized in alert and log generation.
Note: This variable is const, so may only be changed via redef.

omit_rewrite_place_holder : bool

If true, omit place holder packets when rewriting. Fixme: Should this go somewhere else?
Note: This variable is const, so may only be changed via redef.

rewriting_http_trace : bool

If true (default = F), HTTP traces are rewritten.
Note: This variable is const, so may only be changed via redef.

rewriting_smtp_trace : bool

If true (default = F), SMTP traces are rewritten.
Note: This variable is const, so may only be changed via redef.