I have some questions about Bro, thanks!

Zeek
1

Dear all:

I want to get some statistics about past connections.
But the record_connection function in the “conn.bro”, it seems to deal with one connection.

So I need to get the past connection, but I have no idea that which function/event should I modify .

In the Ref-Manual document, I saw the log_hook predefined fumction.
I guess maybe this function is the key for my question.
But I can’t find this function in any file.
Where can I find this function, or I have to create by myself ?
If I have to create by myself, which file should add this funciotn ? (I mean which file should include this function.)

My english is no well, so if it is impolite.
Sorry about that.
Thanks!

Best Regards,
Jack
2007/2/2

2

Hi Jack,

Bro can automatically produce a connection log containing a 1-line
summary of all flows it observes. It sounds like this should be pretty
close to what you want. See here for details:

http://www.bro-ids.org/wiki/index.php/Reference_Manual:_Analyzers_and_Events#Generic_Connection_Analysis

(This is part of the ongoing effort to wikify the manuals, apologies if
it's still looking rough in places.)

Cheers,
Christian.

3

Hi Jack,