TCP Partial Connection

Zeek
1

Hi All,

BRO calls the Protocol Analyzers (for Applications using TCP) only after a
TCP three way handshake has happened.
For example the HTTP event handlers are called after the TCP handshake has
happened and BRO recognizes it as
a HTTP traffic by looking at the destination port.

When I run capture files with a few TCP (HTTP) packets, without the
handshake packets the HTTP event handlers were not called in this case. I
suppose BRO will recognize it as TCP packet and then do nothing with the
packet.

How does BRO handle this TCP packets without handshake packets?

Thanks in advance,
Dhanesh.

2

When I run capture files with a few TCP (HTTP) packets, without the
handshake packets the HTTP event handlers were not called in this case. I
suppose BRO will recognize it as TCP packet and then do nothing with the
packet.

How does BRO handle this TCP packets without handshake packets?

It is customized per analyzer. Some analyzers designate that they
can analyze partial connections, while others cannot. (It boils down
to how likely is the analyzer to be able to synchronize its parsing
given it's starting in the middle of a connection.)

    Vern