Connection Events related to scan.bro

Hello.

I am trying to understand the scanning algorithm, and am having some
slight problems understanding when certain events are generated. Below
I have included a list of the events I am interested in and my best
understanding:

connection_established
   A TCP handshake has been completed successfully.
partial_connection
   ?
connection_attempt
   A TCP SYN packet has been sent.
connection_rejected
   A TCP RST was seen in response to a TCP SYN.
connection_pending
   I am not too sure about this one. Can this only happen if the
analyzer is shut down in the middle of a connection?
connection_half_finished
   Is this when one side of a connection attempts to close a
non-existant connection?

Also, slightly unrelated, I noticed in the udp-common.bro, the code
relating to "use_TRW_algorithm" is commented out... Is there a special
reason for this?

Thanks,
Cameron Hertel

Here's the documentation for those events.
http://www.bro-ids.org/wiki/index.php/Reference_Manual:_Analyzers_and_Events#Generic_TCP_connection_events

   .Seth

There is some problem with the TRW implementation when used with UDP
traffic but I don't recall what exactly it was. The SVN log says:

    r3297 [...] Also, don't analyze UDP traffic, which currently is misaccounted.

Vern, do you remember what this was about?

Robin

There is some problem with the TRW implementation when used with UDP
traffic but I don't recall what exactly it was. The SVN log says:

    r3297 [...] Also, don't analyze UDP traffic, which currently is misaccounted.

Vern, do you remember what this was about?

The current structure of the code treats all UDP "connections" as failures,
which breaks TRW.

    Vern