# flow-level analysis code

**URL:** <https://community.zeek.org/t/flow-level-analysis-code/658>\
**Category:** Zeek\
**Created:** [December 17, 2004, 7:46pm UTC](https://community.zeek.org/t/flow-level-analysis-code/658 "2004-12-17T19:46:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [December 17, 2004, 7:46pm UTC](https://community.zeek.org/t/flow-level-analysis-code/658/1 "2004-12-17T19:46:34Z")

</div>

> I am very interested, but it seems that it is somewhat outside the scope  
> of Bro as a classic NIDS. Reading netflow will make no sense (for Bro)  
> since there is no packet contents.

Actually, I think it does make sense. Bro can do a fair amount of analysis  
based on TCP SYN/FIN/RST packets and UDP request/replies without seeing  
packet contents. For example, its scan detection is driven off of this  
level of information.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Anton\_Chuvakin\_Ph.D](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)\
**Post date:** [December 17, 2004, 8:16pm UTC](https://community.zeek.org/t/flow-level-analysis-code/658/2 "2004-12-17T20:16:27Z")

</div>

> > I am very interested, but it seems that it is somewhat outside the scope  
> > of Bro as a classic NIDS. Reading netflow will make no sense (for Bro)  
> > since there is no packet contents.

> Actually, I think it does make sense. Bro can do a fair amount of analysis  
> based on TCP SYN/FIN/RST packets and UDP request/replies without seeing  
> packet contents. For example, its scan detection is driven off of this  
> level of information.

But where you will take it beyond scans?

Maybe automatic 'stepping stone' detection based on flows? Or flow profiling (for backdoors and trojans with new prots)? It looks like it will be a very different product as a result.

Also, in this case we will see neither contents nor the header, just the fact that seesion took place.

Best,

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/flow-level-analysis-code/658/3 "2022-05-06T15:37:18Z")

</div>

Closed on May 6, 2022, 3:37pm UTC