# Is this type of script is possible to create ?

**URL:** <https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498>\
**Category:** Zeek\
**Created:** [November 19, 2016, 5:35am UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498 "2016-11-19T05:35:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manmeet\_Gill](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@Manmeet\_Gill](https://community.zeek.org/u/Manmeet_Gill)\
**Post date:** [November 19, 2016, 5:35am UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498/1 "2016-11-19T05:35:09Z")

</div>

is it possible that below described statement can be crafted into a bro script ?

Plz help me if it is possible, let me know what i need to do, to make this possible.

If my incoming traffic rate exceeds 44Mbps and the average incoming traffic rate over the last 504seconds exceeds the average incoming traffic rate over the last 965seconds by more than 70%, send an alert

Thank you Everyone.  
MeetGill

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 28, 2016, 11:02pm UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498/2 "2016-11-28T23:02:54Z")

</div>

Hi,

this is actually a bit difficult - there is a function that you can call  
regularly to get you information about the number of packets/bytes that  
Bro received (get\_net\_stats); if you call this every second or so, you can  
determine traffic rates. However, it does not split things out by  
incoming/outgoing connections.

Apart from that the only other idea I have is to use the packet-level  
events and count things manually - however, this will have quite a  
performance impact.

I might be missing an obvious solution I am not thinking about here  
though.

Johanna

---

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [November 29, 2016, 8:12pm UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498/3 "2016-11-29T20:12:16Z")

</div>

You could do this with sumstats... you just have to do a bunch of math... and be happy with an average over a longer period of time. Since you only have to observe two counts, it actually wouldn't be that bad. Just observe the sum of the ip bytes based on which direction the traffic is in.... I could probably write an example script sometime tonight.

---

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [November 29, 2016, 8:24pm UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498/4 "2016-11-29T20:24:28Z")

</div>

Alternatively--and I have no idea what the performance impact of this would be... you could use connection polling: [https://www.bro.org/sphinx/scripts/base/protocols/conn/polling.bro.html](https://www.bro.org/sphinx/scripts/base/protocols/conn/polling.bro.html)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/is-this-type-of-script-is-possible-to-create/4498/5 "2022-05-06T15:44:18Z")

</div>