# Small bug in TCP\_Rewriter **URL:** \ **Category:** Zeek\ **Created:** [July 15, 2005, 9:01pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811 "2005-07-15T21:01:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Martin\_Casado](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@Martin\_Casado](https://community.zeek.org/u/Martin_Casado)\ **Post date:** [July 15, 2005, 9:01pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/1 "2005-07-15T21:01:50Z")
Hi, This may already be fixed but I believe there is a bug in the TCP rewriter. I'm using bro 0.9a10.5. File TCP\_Rewriter.cc, Line 710:        ASSERT(next\_packet-\>AppendData(data, left)); If the ASSERT preprocessor conditional isn't enabled, the statement isn't included in the translation unit and using -A for re-writing doesn't include any payload (only headers) ☹ perhaps ..          if(!next\_packet-\>AppendData(data, left))          { ASSERT(0); } Plz. let me know if this isn't the appropriate forum for submitting bugs. cheers, .martin ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [July 15, 2005, 9:36pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/2 "2005-07-15T21:36:53Z")
Hey Martin 🙂 > Hi, > > This may already be fixed but I believe there is a bug in the TCP > rewriter. I'm using > bro 0.9a10.5. > > File TCP\_Rewriter.cc, Line 710: > >        ASSERT(next\_packet-\>AppendData(data, left)); > > If the ASSERT preprocessor conditional isn't enabled, the statement > isn't included in the > translation unit and using -A for re-writing doesn't include any > payload (only headers) ☹ Uh-oh. Smells rotten to me! > Plz. let me know if this isn't the appropriate forum for submitting bugs. Oh definitely. Keep 'em coming... Cheers, Christian. ---
**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\ **Post date:** [July 15, 2005, 11:32pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/3 "2005-07-15T23:32:54Z")
Yes, thanks! This is a bug. And the fix looks right, too. Ruoming ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [July 18, 2005, 3:16pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/4 "2005-07-18T15:16:58Z")
Sirs, What is the best form to analyse the BRO received packets? I need to calculate how many false positives bro detected in a determinated period. I didn't have success in reports, I continue receiving empty reports, then I need to analyse the logs or using other way to detect what event is a false positive and why is not. Please, can you help me? Thanks Angelita ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [July 19, 2005, 7:21pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/5 "2005-07-19T19:21:09Z")
Martin, I pretend to see what alerts bro detects. These information are not enough to analyse if each alert is an attempt or false positive. I need alert information. Do you understand now? tks Angelita ---
**Author:** ![Angelita\_de\_Cassia\_C](https://avatars.discourse-cdn.com/v4/letter/a/85e7bf/32.png) [@Angelita\_de\_Cassia\_C](https://community.zeek.org/u/Angelita_de_Cassia_C)\ **Post date:** [July 22, 2005, 5:35pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/6 "2005-07-22T17:35:44Z")
Hi Jason, I need to understand more the alert, the definition of each column. In your example, could you explain me what each column means? **Sep 18 06:51:41 0.153497 131.243.2.87 131.243.2.13 http 2077 80 tcp 66 239 RSTO X %14** Sep 18 06:51:41 0.162454 131.243.2.87 131.243.2.13 http 2087 80 tcp 70 604 RSTO X %14 Sep 18 06:51:42 0.153911 131.243.2.87 131.243.2.13 http 2100 80 tcp 80 604 RSTO X %14 Sep 18 06:51:42 0.165501 131.243.2.87 131.243.2.13 http 2115 80 tcp 80 604 RSTO X %14 **Date/time:** Sep 18 06:51:42 **Duration of de connection:** 0.153497 **Origin IP** : 131.243.2.87 **Victim IP** : 131.243.2.13 **Victim Protocol:** http **???: 2077** **Victim Port:** 80 **Transport Protocol:** tcp **???: 66** **???: 239 \*\*\* (is this the alert SID0?)** **???: RSTO** **???: X** **???: %14** Does the bro use SID to identify the alert description? Thanks Angelita ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [July 22, 2005, 7:08pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/7 "2005-07-22T19:08:13Z")
Hi there, > Hi Jason, > > I need to understand more the alert, the definition of each column. > > In your example, could you explain me what each column means? > > Sep 18 06:51:41 0.153497 131.243.2.87 131.243.2.13 http 2077 80 tcp 66 239 RSTO X %14 > Sep 18 06:51:41 0.162454 131.243.2.87 131.243.2.13 http 2087 80 tcp 70 604 RSTO X %14 > Sep 18 06:51:42 0.153911 131.243.2.87 131.243.2.13 http 2100 80 tcp 80 604 RSTO X %14 > Sep 18 06:51:42 0.165501 131.243.2.87 131.243.2.13 http 2115 80 tcp 80 604 RSTO X %14 > > Date/time: Sep 18 06:51:42 > Duration of de connection: 0.153497 > Origin IP: 131.243.2.87 > Victim IP: 131.243.2.13 > Victim Protocol: http > ???: 2077 Source port. > Victim Port: 80 > Transport Protocol: tcp > ???: 66 Bytes sent by originator. > ???: 239 \*\*\* (is this the alert SID0?) Bytes sent by responder. > ???: RSTO Connection state: [http://www.bro-ids.org/Bro-reference-manual/Connection-summaries.html](http://www.bro-ids.org/Bro-reference-manual/Connection-summaries.html) > ???: X Connection flags, see same URL. > ???: %14 That's additional data as reported by the analyzer, in this case, the HTTP analyzer. You can use these for correlation (a "primary key" of sorts). [http://www.bro-ids.org/Bro-reference-manual/http-variables.html](http://www.bro-ids.org/Bro-reference-manual/http-variables.html) Cheers, Christian. ---
**Author:** ![Jason\_Lee](https://avatars.discourse-cdn.com/v4/letter/j/a9adbd/32.png) [@Jason\_Lee](https://community.zeek.org/u/Jason_Lee)\ **Post date:** [July 22, 2005, 7:17pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/8 "2005-07-22T19:17:55Z")
Angelita, [http://www.bro-ids.org/Bro-reference-manual/Connection-summaries.html](http://www.bro-ids.org/Bro-reference-manual/Connection-summaries.html) Explains how the fields are structured, but its a little out of date. I'll fill in the missing parts and see that the manual gets updated. Given a line like this from the conn.log: 1122055977.662564 0.105927 10.1.1.1 10.2.2.2 http 55985 80 tcp 735 12946 SF L %71 Unix Date/time: 1122055977.662564 Duration of the connection: 0.105927 Originator IP: 10.1.1.1 Responder IP: 10.2.2.2 Protocol: http Originator port: 55985 Responder port: 80 Transport Protocol: tcp Originator bytes sent: 735 Responder bytes sent: 12946 Flags: SF (Normal connection saw both SYN and FIN packets) Additional Flags: L (connection was initiated locally) Tag: %71 Now I can take my tag, and look in the http.log to find out more about that connection (i'm running the http analyzer): http.log looks like this (example): 1121793380.980924 %71 start 10.1.1.1 \> 10.2.2.2 1121793380.985317 %71 GET /foo/bar/baz.html (200 "OK" [145]) Having said all this, the alarm.log is very different, its a 'tagged' format that is fairly self descriptive. This is an example from the alarm.log file: t=1000057981.940712 no=AddressScan na=NOTICE\_ALARM\_ALWAYS sa=10.1.1.1 sp=2222/tcp da=10.2.2.2 dp=3333/tcp msg=10.1.1.1\ has\ scanned\ 2000\ hosts\ (3333/tcp ) tag=@42 t: time no: notice na: notice action sa: source address sp: source port dp: destination port msg: message (in this case a host has scanned 20 hosts) tag: identifier to match this to lines in notice.log and conn.log: Now you can take the tag and look in the conn.log to find the connection (with grep): 1000057956.062082 ? 10.1.1.1 10.2.2.2 other 2222 3333 tcp ? ? S0 X @142 (we can see that it didn't connect and no bytes were transfered) Also there is a good section in the manual about alarms: [http://www.bro-ids.org/Bro-user-manual/Analysis-of-Incidents-and-Alarms.html#Analysis-of-Incidents-and-Alarms](http://www.bro-ids.org/Bro-user-manual/Analysis-of-Incidents-and-Alarms.html#Analysis-of-Incidents-and-Alarms) That should help explain the sort ids. Hope this helps. Cheers, jason Angelita de Cássia Corrêa wrote: ---
**Author:** ![Antonatos\_Spiros](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Antonatos\_Spiros](https://community.zeek.org/u/Antonatos_Spiros)\ **Post date:** [July 23, 2005, 10:01am UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/9 "2005-07-23T10:01:06Z")
Hi,   I am trying to use the anonymization features of bro but it seems that I can't enable it since no packets are written to output or log files. Is there any documentation about these features? Any example policy scripts? Thanks in advance, Antonatos Spiros ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/small-bug-in-tcp-rewriter/811/10 "2022-05-06T15:37:35Z")