question about event http_stats

Zeek
1

Hi All,
I am writing some bro script to analysis http session, and I have some
question about those events

#global http_stats: event(c: connection, stats: http_stats_rec);

the http_stats event, I think it is raised when one http session is
done? But why
the stats$num_requests can be 0?

I noticed in the http.bro, there is one handler for this event but
then annotated.

2

#global http_stats: event(c: connection, stats: http_stats_rec);

the http_stats event, I think it is raised when one http session is
done? But why
the stats$num_requests can be 0?

I would expect (and looking briefly at the code this appears to be true)
that an http_stats event is generated whenever an HTTP connection finishes,
even if nothing happened during the connection (no GET request, just a
SYN handshake). If so, then it would make sense that such unproductive
sessions have $num_requests equal to 0.

I noticed in the http.bro, there is one handler for this event but
then annotated.

I'm not following this comment ...

    Vern

3

Thanks Vern.
I mean in the $brohome /share/bro/ folder, the http.bro file. It have
an event handler for the http_stats event. But made invalid using "#".
I thought it was because stats$num_requests is 0. But get over it.
Thanks

Sen