scheduled tasks on existing pcaps

Zeek
1

Howdy,

We’re doing some fairly simple analysis regarding concurrent connections on existing pcaps. Bro basically does all of that for us, but I’m hoping to output the current number of active connections every few seconds.

Do Bro’s scheduled tasks run in real time or network time when a pcap is passed to it? I’m assuming real time, so my next question would be what’s the best way to output a regular status in original network time? I could fake it with tcpreplay, but I’d like to avoid that.

Thanks,
Dop

2

No, it's network time actually, which drives pretty much everything in
Bro so that output doesn't differ when running live vs from a trace.

Robin