> I have one more question: when Bro detected a Stepping Stone , it show
us a
> time. Is the time
> when Bro see a packet belong to the Chain?It's the time when Bro's algorithm has determined that a stepping stone
exists.
You could follow the logic in stepping.bro regarding when it generates
this
output in order to determine this.
stepping.bro use the function of networktime() to report the time.
And networktime() is the time , when see the packet!
It is different to the currenttime().
Have a nice day!
-- cloud