Hey all, So I'm getting bro and elasticsearch going, with one of the goals of finding flows with no service field. That being said I am seeing that long session, at least I THINK that's what I'm seeing, appear to be counted twice. From conn.log: 2016-09-28T12:29:39-0600 192.168.1.101 44083 …

I get the same in elasticsearch. But its got nothing to do with it. Bro seems to split the socket because of the time inbetween the activity. You can avoid this by longer timeouts. It would be better to create a script that keeps track of all ssl connections in memory/broker. I had to co…

Thanks Danial. Is there a way to tell bro to have a longer timeout? Thank you. James

/usr/local/bro/share/bro/base/init-bare.bro ## If a TCP connection is inactive, time it out after this interval. If 0 secs, ## then don't time it out.

Beautiful thank you....bet I need to redef these and stick it in my local.bro. Thanks again..helps me make this more awesome :slight_smile: James

Wow, you're actually seeing 15 minute where there are no packets seen in the connection? I'm surprised that Facebook has such a long timeout on their frontend web servers. I would expect that a timeout that long would actually cause quite a few middle boxes quite a bit of consternation as well. …

Heh....spotify is even worse :stuck_out_tongue: notice.log:1475161562.899483 CPEyXm4oD4iu0xu4v1 192.168.1.101 42263 193.235.203.66 4070 - - - tcp LongConnection::found 192.168.1.101 -> 193.235.203.66:4070/tcp remained alive for longer than 49m42s 2981.66 19…

Quick question on conn tracking

Zeek

Daniel_Guerra September 29, 2016, 4:15pm 8

It seems to pop up with a few types of history .. here RSTRH
104.70.5.52 (akemai/itunes) has ^fR

Topic		Replies	Views
long SSH connection in conn.log Zeek	3	151	May 6, 2022
Conn log shows massive file transfer inbetween normal browsing Zeek	8	138	May 6, 2022
Connection lasts huge time Zeek	2	84	May 6, 2022
How to count concurrent connections Zeek	4	187	May 6, 2022
TCP Conn Log Zeek	3	132	May 6, 2022

Quick question on conn tracking

Related topics