Reporting time

> I have one more question: when Bro detected a Stepping Stone , it show

us a

> time. Is the time
> when Bro see a packet belong to the Chain?

It's the time when Bro's algorithm has determined that a stepping stone

exists.

You could follow the logic in stepping.bro regarding when it generates

this

output in order to determine this.

stepping.bro use the function of networktime() to report the time.
And networktime() is the time , when see the packet!
It is different to the currenttime().

Have a nice day!
-- cloud