Next: Generic Connection Analysis Up: Analyzers and Events Previous: Activating an Analyzer Contents Index

#
General Processing Events

Bro provides the following events relating to its overall processing:

  [``bro_init ()``] generated when Bro first starts up. In particular, after Bro has initialized the network (or initialized to read from a save file) and executed any initializations and global statements (§ ), and just before Bro begins to read packets from the network input source(s).

  [``net_done (t: time)``] generated when Bro has finished reading from the network, due to either having exhausted reading the save file(s), or having received a terminating signal (§ ). Deficiency: This event is generated on a terminating signal even if Bro is not reading network traffic. `t` gives the time at which network processing finished.

  This event is generated before `bro_done`. Note: If Bro terminates due to an invocation of `exit`, then this event is not generated.

  [``bro_done ()``] generated when Bro is about to terminate, either due to having exhausted reading the save file(s), receiving a terminating signal (§ ), or because Bro was run without the network input source and has finished executing any global statements (§ ).

  This event is generated after `net_done`. If you have cleanup that only needs to be done when processing network traffic, it likely is better done using `net_done`. Note: If Bro terminates due to an invocation of `exit`, then this event is not generated.

  [``bro_signal (signal: count)``] generated when Bro receives a signal. Currently, the signals Bro handles are SIGTERM, SIGINT, and SIGHUP.

  Receiving either of the first two terminates Bro, though if Bro is in the middle of processing a set of events, it first finishes with them before shutting down. The shutdown leads to invocations of `net_done` and `bro_done`, in that order. Deficiency: In this case, Bro fails to invoke `bro_signal`, clearly a bug.

  Upon receiving SIGHUP, Bro invokes `flush_all` (in addition to your handler, if any).

  [``net_stats_update (t: time, ns: net_stats)``] This event includes two arguments, `t`, the `time` at which the event was generated, and `ns`, a `net_stats` record, as defined in Figure 7.2. Regarding this second parameter, the `pkts_recvd` field gives the total number of packets accepted by the packet filter so far during this execution of Bro; `pkts_dropped` gives the total number of packets reported dropped by the kernel; and `interface_drops` gives the total number of packets reported by the kernel as having been dropped by the network interface.

  Note: An important consideration is that, as shown by experience, the kernel's reporting of these statistics is not always accurate. In particular, the `$pkts_dropped` statistic is sometimes missing actual packet drops, and some operating systems do not support the `interface_drops` statistic at all. See the `ack_above_hole` event for an alternate way to detect if packets are being dropped.

Figure 7.2: Definition of the `net_stats` record.

Next: Generic Connection Analysis Up: Analyzers and Events Previous: Activating an Analyzer Contents Index