Next: The hot Analyzer Up: Analyzers and Events Previous: Generic Connection Analysis Contents Index
Subsections

- Site variables
- Site-specific functions

#
Site-specific information

The `site` analyzer is not actually an analyzer but simply a set of global variables (and one function) used to define a site's basic topological information.

##
Site variables

The `site` module defines the following variables, all redefinable:

  [``local_nets : set[net]``] Defines which `net`'s Bro should consider as reflecting a local address.

  Default: empty.

  [``local_16_nets : set[net]``] Defines which /16 prefixes Bro should consider as reflecting a local address. Deficiency: Bro currently is inconsistent regarding when it consults `local_nets` versus `local_16_nets`, so you should ensure that this variable and the previous one are always consistent.

  Default: empty.

  [``local_24_nets : set[net]``] The same, but for /24 addresses.

  Default: empty.

  [``neighbor_nets : set[net]``] Defines which `net`'s Bro should consider as reflecting a ``neighbor.'' Neighbors networks can be treated specially in some policies, distinct from other non-local addresses. In particular, `drop_address` will not drop connectivity to an address belonging to a neighbor.

  The notion is somewhat historical, as is the use of ```U`'' to mark neighbors in connection summaries (§ ).

  Default: empty.

  [``neighbor_16_nets : set[addr]``] Defines which /16 addresses Bro should consider as reflecting a neighbor; the only use of this variable in the standard scripts is that a scan originating from an address with one of these prefixes will not be dropped (§ ). Deficiency: The name is poorly chosen and should be changed to better reflect this use. Deficiency: In addition, this variable should be kept consistent with `neighbor_nets`, until the fine day when the processing is rectified to only use one variable.

  Default: empty.

  [``neighbor_24_nets : set[net]``] The same, but for /24 addresses.

  Default: empty.

##
Site-specific functions

Currently, the `site` module only defines one function:

  [``is_local_addr`(a: addr): bool``` ] returns true if the given address belongs to one of the ``local'' networks, false otherwise. Currently, the test is made by masking the address to /16 and /24 and comparing it to `local_16_nets` and `local_24_nets`.

Next: The hot Analyzer Up: Analyzers and Events Previous: Generic Connection Analysis Contents Index