The demux utility module provides a single function:
The originator-to-responder direction of the connection goes into a file named:
and the other direction in:<
otag>.<
tag>.<
orig-addr>.<
orig-port>-<
resp-addr>.<
resp-port>
Accordingly, tag can be used to associate a unique label with the pair of files, while otag and rtag provide distinct labels for the two directions.<
rtag>.<
tag>.<
resp-addr>.<
resp-port>-<
orig-addr>.<
orig-port>
If Bro is already demuxing the connection, or if the connection is not active, then nothing happens, and the function returns false. Otherwise, it returns true.
Bro places demuxed streams in a directory defined by the redefinable global demux_dir, which defaults in the usual fashion to open_log_file("xscript").
Deficiency: Experience has shown that it would be highly convenient if
Bro would demultiplex the entire connection contents into the
files, instead of just the part of the connection seen subsequently
after the call
to demux_conn. One way to do this would be for demux_conn to
offset the contents in the file by the current stream position, and then
to invoke a utility tool that goes through the Bro output trace file
(§