Next: The weird Module Up: Analyzers and Events Previous: The portmapper Analyzer Contents Index

#
The `analy` Analyzer

The `analy` analyzer provides a limited mechanism to use Bro to do statistical analysis on TCP connections. Its primary purpose is to demonstrate that Bro has applications to network traffic analysis beyond intrusion detection. It defines one event handler:

Table: `endpoint_stats` fields for summarizing connection endpoint statistics, all of type `count`.
Field | Meaning
`num_pkts` | The number of packets sent by the endpoint, as seen by the monitor. The endpoint may have sent others that the network dropped upstream from the monitor.
`num_rxmit` | The number of packets retransmitted by the endpoint, as seen by the monitor.
`num_rxmit_bytes` | The number of bytes retransmitted by the endpoint.
`num_in_order` | The number of packets sent by the endpoint that arrived at the monitor in order, where ``in order'' means in the same order as sent by the endpoint, rather than in sequence number. (Thus, a retransmission can arrive in order, by this definition.) Bro determines if the packet arrived in order by applying heuristics to the IP identification (ID) field, which in general will increase by a small amount between successive packets transmitted by an endpoint.
`num_OO` | The number of packets sent by the endpoint that arrived at the monitor out of order. See the previous entry for the definition of ``in order'', and hence ``out of order.''
`num_repl` | The number of extra copies of packets sent by the endpoint that arrived at the monitor. Bro considers a packet replicated if its IP ID field is the same as for the previous packet it saw from the endpoint. Using this definition, a replication is most likely caused by a network mechanism such as duplication of a packet by a router, rather than a transport mechanism such as retransmission, though some TCPs fully reuse packets when retransmitting them, including their IP ID field.
`endian_type` | Whether the advance of the IP ID field as seen by the monitor was consistent with big-endian (network order) addition, little-endian, or undetermined. The three values are represented by the Bro constants `ENDIAN_BIG`, `ENDIAN_LITTLE`, and `ENDIAN_UNKNOWN`. In addition, the value can be `ENDIAN_CONFUSED`, meaning that the monitor saw conflicting evidence for little- and big-endian.

  [``conn_stats (c: connection, os: endpoint_stats, rs: endpoint_stats)``] Invoked for each connection when it terminates (for whatever reason). `os` and `rs` are the statistics for the originator endpoint and the responder endpoint, respectively; Table 7.21 gives the different record fields.

Next: The weird Module Up: Analyzers and Events Previous: The portmapper Analyzer Contents Index