Getting flow stats from Bro

Zeek
1

Is there an existing set of scripts for Bro to get flow stats?

I’m looking for counts, avg, and std dev on small packets, large packets, nonempty packets, interarrival times, etc, similar to what YAF gives with the --flow-stats option. I’m also interested in the Shannon entropy of the payload, similar to what YAF gives with the --entropy option.
https://tools.netsa.cert.org/yaf/yaf.html

  • Jim
2

Not set of scripts for this that I'm aware of. The closest thing I'm
aware of is this script for computing PCR, which might be a good
jumping-off point at least:

https://github.com/reservoirlabs/bro-producer-consumer-ratio

  --Vlad

Jim Simpson <jim.simpson.work@gmail.com> writes: