> I have one more question: when Bro detected a Stepping Stone , it show
> time. Is the time
> when Bro see a packet belong to the Chain?
It's the time when Bro's algorithm has determined that a stepping stone
You could follow the logic in stepping.bro regarding when it generates
output in order to determine this.
stepping.bro use the function of networktime() to report the time.
And networktime() is the time , when see the packet!
It is different to the currenttime().
Have a nice day!