I am looking at extending Bro to help with traffic isolation. What I need to be able to do is differentiate between traffic that matches a given set of criteria and that which does not. In general, I know this can be done through the policies, and I believe I can do most of what I want within a po…

1) Is it possible to denote particular packets in a capture? I know No, not really. The main problem here is that the link between most event handlers and the actual packets is pretty weak. In general, Bro does not give guarantees about when a particular event is raised and also doesn't keep …

In trying to get the contents of http sessions, I have run http-body.bro against a pcap, and there is not output to http.log. This is the same with most http-<x> scripts, except http-reply. Looking at the traces, I am seeing only 'connection_state_remove' from the main HTTP module for http-body, …

The HTTP scripts are a bit different from other analyzers in the sense that they are "incremental", i.e., you typically need to load more than one depending on which parts of the HTTP sessions you want to analyze. The minimum is http-request.bro which analyzes client-side requests. You can add …

I am working on a Traffic Generator (TG) project. Our TG has static content for webpages and fileshares. In addition, we know when our TG hosts attempt to access that data. Given those to things, I want to be able to take a network capture, run it through a system and separate out traffic that we…

On Wed, Oct 03, 2007 at 10:04:33AM -0400, Reed Porada composed: > No, not really. The main problem here is that the link between most > event handlers and the actual packets is pretty weak. In general, > Bro does not give guarantees about when a particular event is raised > and also doesn't kee…

Our synthetic traffic is not any different than if a normal user was on a machine generating the traffic. Meaning that we use IE to navigate to a page, and we use Windows File Browsing to look at network file shares. Our TG is designed to be run on an isolated network, ala DETER, thus we setup a s…

On Wed, Oct 03, 2007 at 11:14:45AM -0400, Reed Porada composed: > >On Wed, Oct 03, 2007 at 10:04:33AM -0400, Reed Porada composed: > >>I am working on a Traffic Generator (TG) project. Our TG has static >>content for webpages and fileshares. In addition, we know when our >>TG hosts attempt …

Yeah, that was my thought too. (This is an offline scheme, isn't it?) If I understood your approach correctly, you depend on application-layer analysis to find "your" traffic. In that case, doing it in a single pass would likely miss packets because you might only be able to take the decision s…

For offline processing, do a two-pass approach. In the first pass, you use Bro to find the TG flows based on the higher-level attributes, and write out the flow IDs. For the second pass, only capture the flows which don't correspond. Yeah, that was my thought too. (This is an offline schem…

Questions about Bro Capabilities

Zeek

Topic		Replies	Views
Using BRO for measuring TCP flow bandwidth Zeek	18	255	May 6, 2022
using Bro as traffic analyzer. Zeek	18	161	May 6, 2022
Applying Bro on offline captured traffic? Zeek	1	84	May 6, 2022
Traffic analysis by Bro Zeek	8	123	May 6, 2022
Hello, I'm the beginner of Bro, Seonmin. Zeek	2	94	May 6, 2022

Questions about Bro Capabilities

Related topics