TCP Conn Log

Zeek
1

Hello,

I am using Bro for a project and I have a question regarding it’s capabilities.
Currently when I have a long TCP connection that includes frequent TCP Keep Alive messages, bro is reassembling the whole network trace into one connection and presents it in conn.log with a big duration value. Is it possible to make bro split up TCP connections into smaller fragments based on a interval I set up or at least whenever a TCP Keep alive handshake takes place?

Regards,
Mike

2

Hi Mike,

I am currently not aware of any way to accomplish this without
modifications to the core. You can change the timeout that Bro uses for
TCP connections (the time after which its expires a connection, if it does
not see any packets) by changing tcp_inactivity_timeout; depending on your
specific application, maybe that might be good enough.

Johanna

3

Oh! there is this script that may help:

https://github.com/corelight/bro-long-connections