Index - Bro Reference Guide

Previous: References, Up: Top

Index

$$ record constructor operator: Expressions
$$ record field access operator: Expressions
& or short-circuit"|"| short-circuit ``or'': Expressions
& or short-circuit"|"| short-circuit ``or'': Logical Operators
& short-circuit&& short-circuit ``and'': Expressions
& short-circuit&& short-circuit ``and'': Logical Operators
& z not", ``not'' operator: Logical Operators
== equality operator== equality operator: Expressions
== equality operator== equality operator: Comparison Operators
== inequality operator", = inequality operator: Expressions
== inequality operator", = inequality operator: Comparison Operators
== less-than operator< less-than operator: Expressions
== less-than operator< less-than operator: Comparison Operators
== less-than-or-equal operator<= less-or-equal operator: Expressions
== less-than-or-equal operator<= less-or-equal operator: Comparison Operators
== z operator> greater-than operator: Expressions
== z operator> greater-than operator: Comparison Operators
== zz operator>= greater-or-equal operator: Expressions
== zz operator>= greater-or-equal operator: Comparison Operators
?$?$ record field test: Expressions
aborted execution: Flags
absolute time: Temporal Types
access, allowable /16 network pairs: hot variables
access, allowable address pairs: hot variables
access, allowable services: hot variables
access, fatal inbound services: hot variables
access, forbidden attempted services: hot variables
access, forbidden inbound services: hot variables
access, forbidden services: hot variables
access, sensitive /24 destination networks: hot variables
access, sensitive /24 source networks: hot variables
access, sensitive destination addresses: hot variables
access, sensitive source addresses: hot variables
access, service allowed to a particular host: hot variables
access, service allowed to particular host pairs: hot variables
acknowledgment holes: Additional handlers for weird events
add expression: Statements
addition, numeric: Arithmetic Operators
addition, temporal: Temporal Addition
additional information associated with a connection: Connection summaries
additional information associated with a connection: connection record
address masking: Predefined Functions
address masking: Net Type
address scanning: scan Analyzer
address type: Address Operators
address type: Address Type
address type, constants: Address Constants
address type, operators: Address Operators
addresses, hot destinations: hot variables
addresses, hot sources: hot variables
addresses, in a connection: Connection summaries
addresses, local: Site-specific functions
addresses, local: Site variables
addresses, mapping to hostnames: hf utility
addresses, neighbor: Site variables
allowable /16 network pairs: hot variables
allowable address pairs: hot variables
altering log files: login variables
analysis, bidirectional vs. unidirectional: Events handled by conn_weird
analysis, off-line: Connection functions
analysis, off-line: Predefined Functions
analysis, off-line: Flags
analysis, off-line: Traffic traces
analysis, on-line: Connection functions
analysis, on-line: Predefined Functions
analysis, on-line: Uncategorized
analysis, on-line: Flags
analysis, on-line: Live traffic
analyzers: interconn Analyzer
analyzers: Analyzers and Events
analyzers, activating: Activating an Analyzer
analyzers, application-specific: portmapper event handlers
analyzers, application-specific: finger Analyzer
analyzers, filtering: Filtering
analyzers, finger: finger event handlers
analyzers, finger, event handlers: finger event handlers
analyzers, finger, variables: finger variables
analyzers, ftp, event handlers: ftp event handlers
analyzers, ftp, functions: ftp functions
analyzers, ftp, variables: ftp variables
analyzers, generic: Connection functions
analyzers, generic: Generic Connection Analysis
analyzers, hot, functions: hot functions
analyzers, hot, variables: hot variables
analyzers, http, event handlers: http event handlers
analyzers, http, variables: http variables
analyzers, ident, event handlers: ident event handlers
analyzers, ident, variables: ident variables
analyzers, instantiating: Activating an Analyzer
analyzers, login, event handlers: login event handlers
analyzers, login, functions: login functions
analyzers, login, variables: login variables
analyzers, portmapper, event handlers: portmapper event handlers
analyzers, portmapper, functions: portmapper functions
analyzers, portmapper, variables: portmapper variables
analyzers, scan, event handlers: scan event handlers
analyzers, scan, functions: scan functions
analyzers, scan, variables: scan variables
analyzers, site-specific information: Site-specific functions
analyzers, site-specific information: Site-specific information
analyzers, SSL, event handlers: SSL event handlers
analyzers, SSL, variables: SSL variables
analyzers,loading: Loading Analyzers
and operator&& ``and'' operator: Expressions
and operator&& ``and'' operator: Logical Operators
anticode.com: login variables
any type``any'' type: any type
any type, replacing with union type: Predefined Functions
appending to a file: Predefined Functions
array, associative: Tables
array, multi-dimensional: Declaring Tables
ASCII, as usual character set: String Operators
assigning records: Record Assignment
associative array: Tables
attack, Land: hot functions
attackers, weenie: hot-ids Module
attacks, smurf: login variables
attempted connections: Generic TCP connection events
attempted services, forbidden: hot variables
attributes: Attributes
authentication dialog: login analyzer confusion
authentication dialog: login Analyzer
authentication dialog: Predefined Functions
authentication, accepted: login event handlers
authentication, rejected: login event handlers
authentication, skipped: login event handlers
avoiding processing: Predefined Functions
backdoor, avoiding false positives: login variables
backdoor, prompts: login variables
backdoor, triggered by ephemeral port: login variables
backdoor, triggered by terminal type: login variables
backspace character: Predefined Functions
beginning time of a connection: Connection summaries
beginning time of a connection: connection record
bidirectional vs. unidirectional analysis: Events handled by conn_weird
big endian: Predefined Functions
BIND, non-blocking DNS lookups: Bro source code distribution
booleans: Logical Operators
booleans: Booleans
Bourne shell: Predefined Functions
BPF (Berkeley Packet Filter), tuning: Tuning BPF
BPF buffers, ensuring they are large: Tuning BPF
break expression: Statements
Bro bugs/limitations, causing ``weird'' events: weird Module
bro suffix.bro suffix: Run-time environment
Bro!references: Introduction
Bro, checkpointing: Flags
Bro, execution aborted: Flags
Bro, installing: Building and installing Bro
Bro, interactive use: Using Bro interactively
Bro, not running as root: Tuning BPF
Bro, optimizer: Flags
Bro, private caches: Flags
Bro, running: Running Bro
Bro, search path: Run-time environment
Bro, source code: Bro source code distribution
Bro, system configuration: Tuning BPF
Bro, usage: Flags
Bro, version: Flags
Bro, watchdog: Flags
Bro, web page: Bro source code distribution
Bro, wedging: Flags
bro-dns-cache.bro-dns-cache: dns Module
BS: Predefined Functions
buffer overflow tools: login variables
buffers, large for BPF: Tuning BPF
buggy implementations, causing ``weird'' events: weird Module
bugs, $ pattern operator not supported: Embedded Pattern Matching
bugs, appalling: Additional handlers for weird events
bugs, causing ``weird'' events: weird Module
bugs,tcpdump: Filtering
building Bro: Building and installing Bro
bytes in connection: Connection functions
bytes in connection: Connection summaries
caches, Bro's private ones: Flags
casting, not provided in Bro: any type
Central Intelligence Agency, detection: hot variables
character set, ASCII: String Operators
checkpointing Bro: Flags
checksum error, ICMP: Events handled by conn_weird
checksum error, IP: Events handled by net_weird
checksum error, TCP: Events handled by conn_weird
checksum error, UDP: Events handled by conn_weird
Christmas packet: Events handled by conn_weird
CIA detection: hot variables
CIDR: Site variables
CIDR: Predefined Functions
CIDR: Net Type
cleanup event: General Processing Events
client port, triggering a backdoor: login variables
clock time: Predefined Functions
Cold Fusion exploits: http variables
command shell: Predefined Functions
command shell, setuid root: login variables
compiling Bro: Building and installing Bro
completed connections: Generic TCP connection events
compound expression: Statements
concatenation of strings: Predefined Functions
confused login analysis: login analyzer confusion
confusion of heuristics: login analyzer confusion
connection events, TCP-specific: Generic TCP connection events
connection ID: Connection functions
connection record: connection record
connection size, undetermined for RST termination: ftp variables
connection, additional information: Connection summaries
connection, additional information: connection record
connection, addresses: Connection summaries
connection, addresses: connection record
connection, analysis: analy Analyzer
connection, analysis: hot Analyzer
connection, analysis: Generic Connection Analysis
connection, attempt: Generic TCP connection events
connection, bytes: Connection functions
connection, bytes: Connection summaries
connection, bytes: connection record
connection, completion: Generic TCP connection events
connection, definitions: Definitions of connections
connection, detecting sensitive: hot functions
connection, duration: Connection summaries
connection, duration: connection record
connection, establishment: Generic TCP connection events
connection, events: Generic TCP connection events
connection, finished: Generic TCP connection events
connection, flags: Connection summaries
connection, functions: Connection functions
connection, generic analysis: Generic Connection Analysis
connection, half finished: Generic TCP connection events
connection, hosts: Connection summaries
connection, hot: login functions
connection, hot: Connection functions
connection, hot: connection record
connection, hot analysis: hot Analyzer
connection, ICMP: Definitions of connections
connection, ID: Connection functions
connection, initiator: connection record
connection, logging: Connection functions
connection, new: Generic TCP connection events
connection, non-existing: Run-time errors for non-existing connections
connection, originator: connection record
connection, partial: Generic TCP connection events
connection, partial close: Generic TCP connection events
connection, pending: Generic TCP connection events
connection, ports: connection record
connection, recording: Connection functions
connection, rejected: Generic TCP connection events
connection, reset: Generic TCP connection events
connection, reuse: Events handled by conn_weird
connection, sensitivity: connection record
connection, sequence numbers: Predefined Functions
connection, service: Connection functions
connection, service: connection record
connection, simultaneous open: Events handled by conn_weird
connection, size: Connection functions
connection, size: Connection summaries
connection, size: connection record
connection, start time: Connection summaries
connection, start time: connection record
connection, state: Connection functions
connection, state: Connection summaries
connection, state: connection record
connection, summaries: Connection summaries
connection, TCP: Definitions of connections
connection, terminating with extreme prejudice: Connection functions
connection, UDP: Definitions of connections
connection: testing for existence: Predefined Functions
connectivity, dropping: scan functions
connectivity, dropping: scan variables
constant: Expressions
constant variables: Statements
constants, address: Address Constants
constants, boolean: Boolean Constants
constants, count: Numeric Constants
constants, floating-point: Numeric Constants
constants, hostname: Address Constants
constants, integer: Numeric Constants
constants, interval: Temporal Constants
constants, net: Net Constants
constants, pattern: Pattern Constants
constants, port: Port Constants
constants, record: Record Constants
constants, string: String Constants
constants, temporal: Temporal Constants
constants, time: Temporal Constants
control packets (SYN/FIN/RST): tcp analyzer
control packets (SYN/FIN/RST): Flags
copy, shallow vs. deep: Table Assignment
copy, shallow vs. deep: Record Assignment
corrupted packets: Events handled by net_weird
corrupted packets: Events handled by conn_weird
creating directories: Predefined Functions
crud: weird Module
crud: Generic TCP connection events
daemons, as innocuous user names: ident variables
data, unanalyzed: Events handled by conn_weird
day interval unit: Temporal Constants
debugging,filtering problems: Filtering
decrement: Expressions
deep copy: Table Assignment
deep copy: Record Assignment
default values: Table Attributes
default, filtering: Filtering
DEL: Predefined Functions
delete character: Predefined Functions
delete expression: Statements
denial of service, excessively large fragments: Events handled by flow_weird
denial of service, Land attack: Events generated by the standard scripts
detecting scans: scan Analyzer
detecting sensitive connections: hot functions
dev/bpf: Tuning BPF
directories, creating: Predefined Functions
directory names, sensitive: login variables
diverse network use, causing ``weird'' events: weird Module
division, numeric: Arithmetic Operators
division, temporal: Temporal Division
DMZ, spoof detection: hot variables
DNS lookups, non-blocking: Bro source code distribution
DNS!Bro's private cache, forcing access to: Flags
DNS, Bro's private cache: dns Module
DNS, mappings: dns_mapping record
dotted quads: hf utility
drop-connectivity shell script-connectivity shell script: scan functions
dropping connectivity: scan functions
dropping connectivity: scan variables
duration of a connection: Connection summaries
duration of a connection: connection record
dynamic defaults: Table Attributes
editing: Predefined Functions
eggdrop: ftp variables
encrypted login sessions: login event handlers
encryption, leading to ``excessive lines'': login event handlers
endian issues: Predefined Functions
enumerations: Enumerations
environment, accessing: Predefined Functions
ephemeral port: Connection functions
ephemeral port, triggering a backdoor: login variables
ephemeral ports, confused with sensitive services: hot variables
escape sequences: String Constants
established connections: Generic TCP connection events
etc/inetd.conf/etc/inetd.conf: hot variables
etc/passwd: http variables
etc/shadow: http variables
evasion, authentication dialog: login Analyzer
evasion, excessively small fragments: Events handled by flow_weird
evasion, inconsistent fragment size: Events handled by flow_weird
evasion, inconsistent fragments: Events handled by flow_weird
evasion, inconsistent RPC retransmission: Events handled by conn_weird
evasion, inconsistent TCP retransmission: Additional handlers for weird events
evasion, inserting NULs: String Constants
evasion, length mismatch: Events handled by conn_weird
evasion, using tunneling: login event handlers
event engine: Event handlers
event expression: Statements
event handler, invocation: Event handlers
event handlers: Event handlers
event handling, weird: Additional handlers for weird events
event handling, weird: Events handled by conn_weird
event type: Event handlers
events, exceptional: Additional handlers for weird events
events, exceptional: weird Module
events, finish: General Processing Events
events, general Bro processing: General Processing Events
events, generic TCP connection: Generic TCP connection events
events, initialization: General Processing Events
events, scheduling: Expressions
events, startup: General Processing Events
events, termination: General Processing Events
exceptional events: Additional handlers for weird events
exceptional events: weird Module
excessively long lines: login event handlers
excluding hosts: Filtering
executables, running: Predefined Functions
expiration, timer: Uncategorized
expiration, timer: Expressions
explicit typing: Typing
exploit scans: signature Module
exploits, buffer overflow: login variables
exploits, Unix: login variables
expression: Statements
expressions: Expressions
expressions|(: Expressions
F: Boolean Constants
failure of heuristics: login analyzer confusion
fetch utility: login variables
file type: Files
filenames, sensitive: login variables
filenames, sensitive: ftp variables
files, appending: Predefined Functions
files, opening: Predefined Functions
filtering, default: Filtering
filters: Filtering
filters, displaying: Filtering
filters,errors: Filtering
FIN control packet: tcp analyzer
FIN control packet: Flags
Finger, analysis: finger Analyzer
Finger, weird events: Events handled by conn_weird
finish event: General Processing Events
firewall, reactive: scan functions
firewall, reactive: scan variables
flags of connection: Connection summaries
flex utility: Pattern Constants
for expression: Statements
forcing access to Bro's private DNS cache: Flags
format, precision: Predefined Functions
format, width: Predefined Functions
formatting text: Predefined Functions
forward: ftp variables
fragment reassembly: frag Module
fragments, excessively large: Events handled by flow_weird
fragments, excessively small: Events handled by flow_weird
fragments, inconsistent: Events handled by flow_weird
fragments, inconsistent protocols: Events handled by flow_weird
fragments, inconsistent sizes: Events handled by flow_weird
fragments, overlapping: Events handled by flow_weird
fragments, TCP vs. UDP: frag Module
frogs, dissecting: http variables
ftp session summary file: ftp variables
FTP, analysis: ftp Analyzer
FTP, ephemeral ports confused with sensitive services: hot variables
FTP, log file: ftp variables
FTP, session information: ftp_session_info record
FTP, weird events: Events handled by conn_weird
function invocation: Expressions
function type: Functions
functions: Functions
functions, anonymous: Expressions
functions, redefining: Functions
functions, site-specific: Site-specific functions
general Bro processing events: General Processing Events
general scripting: Predefined Functions
generic connection analysis: Generic Connection Analysis
global scope, of enumerations: Enumerations
global variables: Scope
half-finished connections: Generic TCP connection events
handling signals: General Processing Events
headers, truncated: Events handled by net_weird
help message: Flags
heuristics, confusion: login analyzer confusion
heuristics, extracting username information: login analyzer confusion
heuristics, extracting username information: login Analyzer
horizontal exploit scans: signature Module
host order (vs. network order): Predefined Functions
hostnames: Address Constants
hostnames, mapping addresses to: hf utility
hosts, excluding: Filtering
hosts, in a connection: Connection summaries
hot /24 destination networks: hot variables
hot /24 source networks: hot variables
hot connection, analysis: hot Analyzer
hot connections: login functions
hot destination addresses: hot variables
hot detection: hot functions
hot source addresses: hot variables
hot usernames: hot-ids Module
hr (hours) interval unit: Temporal Constants
HTTP methods: http variables
HTTP packets, contents not being recorded: Flags
http session summary file: http variables
HTTP, analysis: http Analyzer
HTTP, log file: http variables
HTTP, weird events: Events handled by conn_weird
ICMP, checksum error: Events handled by conn_weird
ICMP, connections: Definitions of connections
ICMP, timeout: Definitions of connections
ICMP, weird events: Events handled by conn_weird
ID of connection: Connection functions
IDENT, analysis: ident Analyzer
IDENT, weird events: Events handled by conn_weird_addl
if expression: Statements
implicit typing: Typing
in operator operator: Embedded Pattern Matching
in2 operator", in negation of operator: Embedded Pattern Matching
inbound services, fatal: hot variables
inbound services, forbidden: hot variables
inconsistent acknowledgment: Additional handlers for weird events
inconsistent retransmission: Additional handlers for weird events
inconsistent retransmission: Events handled by conn_weird
increment: Expressions
index, of a table: Tables
inetd.conf.conf: hot variables
inferring types: Typing
information associated with a connection: Connection summaries
information associated with a connection: connection record
initialization event: General Processing Events
initialization of variables: Initialization
input, analysis: login Analyzer
input, editing: login variables
installing Bro: Installing Bro
integers, network vs. host order: Predefined Functions
internal networks, spoof detection: hot variables
Internet Relay Chat (IRC), attacker subpopulation: login variables
interval units, day: Temporal Constants
interval units, hr: Temporal Constants
interval units, min: Temporal Constants
interval units, sec: Temporal Constants
interval units, usec: Temporal Constants
invocation, function: Expressions
invoking event handlers: Event handlers
IP, checksum error: Events handled by net_weird
IP, fragments: Events handled by flow_weird
IP, weird events: Events handled by net_weird
IPv4/IPv6 address constants: Address Constants
IPv6 and lack of CIDR prefixes: Net Type
IPv6 support: Address Type
keystrokes, analysis: login Analyzer
keystrokes, editing: login variables
kiddies, script: hot variables
Land attack: Events generated by the standard scripts
Land attack: hot functions
large BPF buffers: Tuning BPF
left parenthesis operator( operator: Expressions
length mismatch, UDP: Events handled by conn_weird
length, of strings: Predefined Functions
length, of table or set: Predefined Functions
lex utility: Pattern Constants
libpcap buffer size patch: Tuning BPF
line editing: Predefined Functions
Linux, compiling Bro under: Bro source code distribution
Linux, super exploit: login variables
little endian: Predefined Functions
live traffic: Predefined Functions
live traffic: Statements
load, shedding: Predefined Functions
local: Statements
local addresses: Site-specific functions
local addresses: Site variables
local addresses, spoofing: hot functions
local addresses, spoofing: hot variables
local variables: Scope
local variables: Statements
log expression: Statements
log file: log Module
log file: Predefined Functions
log file: Uncategorized
log file, altering: login variables
log file, connection summary (red): Connection functions
log file, FTP: ftp variables
log file, HTTP: http variables
log file, signatures: signature Module
log file, SSL: SSL variables
log file, weird events: weird Module
logging, connection: Connection functions
logging, control of: Predefined Functions
logical negation: Logical Operators
login analysis, confusion: login analyzer confusion
login session: login Analyzer
login session, state: Predefined Functions
ls: login variables
lynx utility: login variables
magic terminal types: login variables
management, of state: Table Attributes
masking: Predefined Functions
maximum: Predefined Functions
Maximum Segment Lifetime (MSL): Events handled by conn_weird
memory management: Table Attributes
min (minutes) interval unit: Temporal Constants
minimum: Predefined Functions
modifiability of variables: Modifiability
modules, dns, event handlers: dns event handlers
modules, dns, variables: dns variables
MSL (Maximum Segment Lifetime): Events handled by conn_weird
multi-dimensional table: Declaring Tables
multiplication, numeric: Arithmetic Operators
multiplication, temporal: Temporal Multiplication
name, of log file: Predefined Functions
names, case-sensitive: Defining records
Napster, tunneled over Telnet or Rlogin: login event handlers
negation: Expressions
negation, logical: Logical Operators
negation, temporal: Temporal Negation
neighbor addresses: Site variables
net type: Net Operators
net type: Net Type
net, constants: Net Constants
net, operators: Net Operators
network cleanup event: General Processing Events
Network File System (NFS): portmapper variables
network interfaces: Uncategorized
network interfaces: Flags
network interfaces: Live traffic
network order (vs. host order): Predefined Functions
network prefixes: Site variables
network prefixes: Predefined Functions
network prefixes: Net Type
network statistics: General Processing Events
Network Virtual Terminal (NVT): login event handlers
networks, hot destinations: hot variables
networks, hot sources: hot variables
new connection: Generic TCP connection events
next expression: Statements
NFS (Network File System): portmapper variables
NFS traffic, high volume fragments: frag Module
non-blocking DNS lookups: Bro source code distribution
not in operator", in negation of operator: Embedded Pattern Matching
not operator", ``not'' operator: Logical Operators
NT, not supported: Supported platforms
NUL: Predefined Functions
null expression: Statements
NULs: Events handled by conn_weird
NULs, allowed in strings: Run-time errors for non-existing connections
NULs, allowed in strings: String Constants
NULs, disallowed in certain function calls: Run-time errors for non-existing connections
NULs, terminating string constants: String Constants
NULs, termination: Run-time errors for non-existing connections
number of elements, in table or set: Predefined Functions
numeric types, count: Bro Types
numeric types, double: Bro Types
numeric types, int: Bro Types
NVT (Network Virtual Terminal): login event handlers
NVT options, authentication: login event handlers
NVT options, bad: login event handlers
NVT options, bad termination: login event handlers
NVT options, encryption: login event handlers
NVT options, inconsistent: login event handlers
off-line analysis: Connection functions
off-line analysis: Predefined Functions
off-line analysis: Flags
off-line analysis: Traffic traces
on-line analysis: Connection functions
on-line analysis: Predefined Functions
on-line analysis: Uncategorized
on-line analysis: Flags
on-line analysis: Live traffic
opening a file: Predefined Functions
operator, and&& ``and'': Expressions
operator, and&& ``and'': Logical Operators
operator, left parenthesis( parenthesis: Expressions
operator, not", ``not'': Logical Operators
operator, or"|"| ``or'': Expressions
operator, or"|"| ``or'': Logical Operators
operator, right parenthesis) parenthesis: Expressions
operators, address: Address Operators
operators, arithmetic: Arithmetic Operators
operators, arithmetic, associativity: Arithmetic Operators
operators, arithmetic, operand conversion: Arithmetic Operators
operators, arithmetic, precedence: Arithmetic Operators
operators, comparison: Comparison Operators
operators, comparison, associativity: Comparison Operators
operators, comparison, operand conversion: Comparison Operators
operators, comparison, precedence: Comparison Operators
operators, logical: Logical Operators
operators, logical, associativity: Logical Operators
operators, logical, precedence: Logical Operators
operators, net: Net Operators
operators, pattern: Pattern Operators
operators, ports: Port Operators
operators, string: String Operators
operators, temporal: Temporal Operators
optimizer for policy script interpreter: Flags
optimizing your system for Bro: Tuning BPF
options, Telnet: login Analyzer
or operator"|"| ``or'' operator: Expressions
or operator"|"| ``or'' operator: Logical Operators
packet filter, access: Tuning BPF
packet filter, permissions: Tuning BPF
packets, control (SYN/FIN/RST): tcp analyzer
packets, control (SYN/FIN/RST): Flags
packets, corrupted: Events handled by net_weird
packets, corrupted: Events handled by conn_weird
packets, drops: Additional handlers for weird events
packets, drops: General Processing Events
packets, recording: Predefined Functions
packets, storms: Events handled by conn_weird
packets, time: Predefined Functions
parentheses operators(): Expressions
partial connections: Generic TCP connection events
partially closed connections: Generic TCP connection events
passwords, guessing: scan Analyzer
passwords, inadvertently exposed: login Analyzer
passwords, sniffing: login Analyzer
pattern matching: Patterns
pattern matching, embedded: Embedded Pattern Matching
pattern matching, exact: Exact Pattern Matching
patterns: Embedded Pattern Matching
patterns: Patterns
pending connections: Generic TCP connection events
percent modulus operator: Arithmetic Operators
performance, analysis tradeoffs: Activating an Analyzer
performance, filtering: Filtering
policy directories: Run-time environment
policy script interpreter, optimizer: Flags
policy/ policy directory: Run-time environment
policy/local/local/ policy directory: Run-time environment
polymorphic functions, need for: Events handled by conn_weird_addl
polymorphic functions, need for: Predefined Functions
port scanning: scan Analyzer
port type: Port Operators
port type: Port Type
port, ephemeral: Connection functions
ports, constants: Port Constants
ports, operators: Port Operators
ports, TCP: Port Type
ports, TCP vs. UDP: Predefined Functions
ports, UDP: Port Type
possible future changes, type: Expressions
possible future changes, breaking string constants across multiple lines: String Constants
possible future changes, constants for absolute times: Temporal Constants
possible future changes, use of any type for bypassing strong typing: any type
precision, of formatted strings: Predefined Functions
predefined functions: Functions for manipulating time
predefined functions: Predefined Functions
predefined variables: Uncategorized
predefined variables: Predefined Variables
prefixes: Run-time environment
prefixes: Flags
prefixes, network: Site variables
prefixes, network: Predefined Functions
prefixes, network: Net Type
priming Bro's private DNS cache: Flags
print expression: Statements
processing, avoiding: Predefined Functions
reactive firewall: scan functions
reactive firewall: scan variables
reading tcpdump files files: Flags
record, connection: connection record
record, ftp_port: Predefined Functions
recorded traffic: Predefined Functions
recording connections: Connection functions
recording packets: Predefined Functions
records: Records
records, assignment: Record Assignment
records, fields: Records
records, fields, accessing: Accessing Fields Using $
records, fields, legal names: Defining records
redefining functions: Functions
redefining variables: Refinement
refinement: Refinement
rejected connections: Generic TCP connection events
relationals, address: Address Type
relationals, net: Net Operators
relationals, numeric: Comparison Operators
relationals, string: String Operators
relationals, temporal: Temporal Relationals
relative time: Temporal Types
remote procedure call (RPC): portmapper Analyzer
reset connections: Generic TCP connection events
restricting traffic: Filtering
retransmission, inconsistent: Additional handlers for weird events
retransmission, inconsistent: Events handled by conn_weird
return expression: Statements
rhosts: login event handlers
rhosts: login variables
rhosts: login analyzer confusion
rhosts: login Analyzer
rhosts: ftp variables
right parenthesis operator) operator: Expressions
Rlogin, session state: Predefined Functions
Rlogin, sessions: login Analyzer
Rlogin, weird events: Events handled by conn_weird
root, backdoors: login variables
root, Bro not running as: Tuning BPF
root, setuid: login variables
routing, split: Events handled by conn_weird
RPC (Remote Procedure Call): portmapper Analyzer
RPC (Remote Procedure Call), reserved multicast address: portmapper variables
RPC (Remote Procedure Call), weird events: Events handled by conn_weird
RST control packet: tcp analyzer
RST control packet: Flags
RST termination, causing undetermined connection size: ftp variables
running Bro: Running Bro
running outside scripts or executables: Predefined Functions
save file, control over what's recorded: Predefined Functions
save file, reading: Flags
save file, writing: Flags
scalars: Declaring Tables
scan detection: scan event handlers
scan detection: scan Analyzer
scanning, address: scan Analyzer
scanning, port: scan Analyzer
scanning, shutting down: scan functions
scanning, shutting down: scan variables
scanning, stealth: Events handled by conn_weird
scanning, stealth: scan functions
scanning, stealth: Generic TCP connection events
scans, exploit: signature Module
scheduling events: Expressions
scoping of variables: Scope
script kiddies: hot variables
scripting, general: Predefined Functions
scripts, running: Predefined Functions
scripts, standard: interconn Analyzer
scripts, standard: Analyzers and Events
search path: Run-time environment
searching for strings: Patterns
sec (seconds) interval unit: Temporal Constants
semi-colon statement termination: Statements
sensitive /24 destination networks: hot variables
sensitive /24 source networks: hot variables
sensitive destination addresses: hot variables
sensitive filenames: login variables
sensitive information, inadvertently exposed: login Analyzer
sensitive services, confused with ephemeral ports: hot variables
sensitive source addresses: hot variables
sensitive usernames: hot-ids Module
sensitivity associated with a connection: connection record
sequence numbers, connection originator: Predefined Functions
sequence numbers, connection responder: Predefined Functions
service associated with a connection: Connection functions
service associated with a connection: Connection summaries
service associated with a connection: connection record
services, allowable: hot variables
services, allowed to a particular host: hot variables
services, allowed to particular host pairs: hot variables
services, fatal if inbound: hot variables
services, forbidden: hot variables
services, forbidden if attempted: hot variables
services, forbidden if inbound: hot variables
set size: Predefined Functions
set type: Sets
setuid root: login variables
shadowing: Filtering
shallow copy: Table Assignment
shallow copy: Record Assignment
shedding load: Predefined Functions
shell escape: Predefined Functions
shell scripts, drop-connectivity-connectivity: scan functions
short-circuit1-circuit && ``and'' operator: Expressions
short-circuit1-circuit && ``and'' operator: Logical Operators
short-circuit2-circuit "|"| ``or'' operator: Expressions
short-circuit2-circuit "|"| ``or'' operator: Logical Operators
shutting down scans: scan functions
shutting down scans: scan variables
SIGHUP: General Processing Events
SIGINT: General Processing Events
signal handling: General Processing Events
signature analysis: signature Module
signatures, log file: signature Module
SIGTERM: General Processing Events
simultaneous open: Events handled by conn_weird
site addresses: Site-specific functions
site-specific, functions: Site-specific functions
site-specific, information: Site-specific information
site-specific, variables: Site variables
size of connection: Connection functions
size of connection: Connection summaries
size, of table or set: Predefined Functions
smurf attacks: login variables
sniffer logs: login variables
sniffing: login Analyzer
source code, for Bro: Bro source code distribution
split routing: Events handled by conn_weird
spoofing, allowable services: hot variables
spoofing, detection: hot functions
spoofing, detection: hot variables
SSL session summary file: SSL variables
SSL, analysis: SSL Analyzer
SSL, connection information: ssl_connection_info record
SSL, log file: SSL variables
SSL, x509: x509 record
standard scripts: interconn Analyzer
standard scripts: Analyzers and Events
start time of a connection: Connection summaries
start time of a connection: connection record
startup, event: General Processing Events
startup, transients: Events handled by conn_weird
state management: Table Attributes
state of connection: Connection functions
state of connection: Connection summaries
state, of a Telnet/Rlogin session: Predefined Functions
statements: Statements
statements, multi-line: Statements
statements, semi-colon temmination: Statements
static typing: Bro Types
statistical analysis: analy Analyzer
stderr: log Module
stderr: Uncategorized
stdout: Statements
stealth scans: Events handled by conn_weird
stealth scans: scan functions
stealth scans: Generic TCP connection events
storms: Events handled by conn_weird
string constants, NUL terminated: String Constants
string, extraction: Predefined Functions
string, formatting: Predefined Functions
strings: String Operators
strings: Strings
strings, cleaned up: Predefined Functions
strings, concatenation: Predefined Functions
strings, length: Predefined Functions
strings, termination with NULs: Run-time errors for non-existing connections
sub-tables, lack of: Accessing Tables
subnets: Site variables
subnets: Predefined Functions
subnets: Net Type
substrings: Predefined Functions
subtraction, numeric: Arithmetic Operators
subtraction, temporal: Temporal Subtraction
SYN control packet: tcp analyzer
SYN control packet: Flags
syslog: Statements
system configuration: Tuning BPF
T: Boolean Constants
T/TCP: Events handled by conn_weird
table size: Predefined Functions
tables: Deleting Table Elements
tables: Tables
tables, clearing entries: Table Assignment
TCP control packets (SYN/FIN/RST): tcp analyzer
TCP control packets (SYN/FIN/RST): Flags
TCP vs. UDP ports: Predefined Functions
TCP Wrappers, reset vs. rejected connections: Generic TCP connection events
TCP, analysis: tcp analyzer
TCP, checksum error: Events handled by conn_weird
TCP, Christmas packet: Events handled by conn_weird
TCP, connections: Definitions of connections
TCP, corrupted header: Events handled by net_weird
TCP, events: Generic TCP connection events
TCP, fragments: frag Module
TCP, transaction: Events handled by conn_weird
TCP, weird events: Events handled by conn_weird
TCP-specific connection events: Generic TCP connection events
tcpdump,bugs: Filtering
Telnet, options: login Analyzer
Telnet, options, authentication: login event handlers
Telnet, options, bad: login event handlers
Telnet, options, bad termination: login event handlers
Telnet, options, encryption: login event handlers
Telnet, options, inconsistent: login event handlers
Telnet, session state: Predefined Functions
Telnet, sessions: login Analyzer
temporal, addition: Temporal Addition
temporal, constants: Temporal Constants
temporal, division: Temporal Division
temporal, multiplication: Temporal Multiplication
temporal, negation: Temporal Negation
temporal, relationals: Temporal Relationals
temporal, subtraction: Temporal Subtraction
temporal, types: Temporal Types
TERM: General Processing Events
terminating connections forcibly: Connection functions
termination event: General Processing Events
text, formatting: Predefined Functions
TFreak: login variables
time: Temporal Relationals
time: Temporal Types
time, clock: Predefined Functions
time, packet: Predefined Functions
timer expiration: Uncategorized
timer expiration: Expressions
timers: Expressions
timestamps, mapping to readable form: cf utility
trace file, control over what's recorded: Predefined Functions
trace file, reading: Flags
trace file, writing: Flags
traffic, live vs. recorded: Predefined Functions
traffic, live vs. recorded: Statements
traffic, restricting: Filtering
transaction TCP: Events handled by conn_weird
transients, startup: Events handled by conn_weird
trojaning: login variables
truncated headers: Events handled by net_weird
tunneling: login event handlers
type casting, not provided in Bro: any type
type inference: Typing
types, addr: Bro Types
types, bool: Logical Operators
types, bool: Bro Types
types, conversion: Type Conversions
types, conversion, automatic: Type Conversions
types, count: Numeric Types
types, count: Bro Types
types, double: Numeric Types
types, double: Bro Types
types, enum: Enumerations
types, enum: Bro Types
types, enumeration: Bro Types
types, event: Bro Types
types, file: Bro Types
types, function: Bro Types
types, int: Numeric Types
types, int: Bro Types
types, interval: Temporal Types
types, interval: Bro Types
types, net: Bro Types
types, numeric: Comparison Operators
types, numeric: Numeric Types
types, numeric: Bro Types
types, numeric, bool not numeric: Mixing Numeric Types
types, numeric, intermixing: Mixing Numeric Types
types, overview: Bro Types
types, pattern: Patterns
types, pattern: Bro Types
types, port: Bro Types
types, record: Bro Types
types, set: Bro Types
types, string: Strings
types, string: Bro Types
types, table: Bro Types
types, temporal: Bro Types
types, time: Temporal Types
types, time: Bro Types
typing of variables: Typing
typing, static: Bro Types
UDP, analysis: udp analyzer
UDP, checksum error: Events handled by conn_weird
UDP, connections``connections'': Definitions of connections
UDP, fragments: frag Module
UDP, length mismatch: Events handled by conn_weird
UDP, timeout: Definitions of connections
UDP, weird events: Events handled by conn_weird
unanalyzed data: Events handled by conn_weird
undirectional analysis: Events handled by conn_weird
union type, need for: Predefined Functions
Unix analysis: login Analyzer
Unix support: Supported platforms
Unix timestamps: cf utility
unusual events: Additional handlers for weird events
unusual events: weird Module
unusual events, prevalence in actual network traffic: weird Module
usage message: Flags
usec (microseconds) interval unit: Temporal Constants
user keystrokes, analysis: login Analyzer
user keystrokes, editing: login variables
usernames, extracting: login analyzer confusion
usernames, extracting: login Analyzer
usernames, sensitive: hot-ids Module
usr/local/lib/bro/usr/local/lib/bro/ policy directory: Run-time environment
utilities, fetch: login variables
utilities, flex: Pattern Constants
utilities, lex: Pattern Constants
utilities, ls: login variables
utilities, lynx: login variables
values, overview: Values Overview
vantage point: Events handled by conn_weird
variable: Expressions
variables, attributes: Attributes
variables, constant: Statements
variables, initialization: Initialization
variables, local: Statements
variables, modifiability: Modifiability
variables, overview: Variables Overview
variables, redefining: Refinement
variables, refinement: Refinement
variables, scope: Statements
variables, scoping: Scope
variables, typing: Typing
version message: Flags
vertical exploit scans: signature Module
walld: portmapper event handlers
walld: portmapper variables
watchdog: Flags
weird event summary file: weird Module
weird events: Additional handlers for weird events
weird events: weird Module
weird events, actions: Actions for weird events
weird events, additional handlers: Additional handlers for weird events
weird events, generated by standard scripts: Events generated by the standard scripts
weird events, handled by conn_weird: Events handled by conn_weird
weird events, handled by conn_weird_addl: Events handled by conn_weird_addl
weird events, handled by flow_weird: Events handled by flow_weird
weird events, handled by net_weird: Events handled by net_weird
weird events, prevalence in actual network traffic: weird Module
whitespace, in statements: Statements
width, of formatted strings: Predefined Functions
Windows, not supported: Supported platforms
write file, control over what's recorded: Predefined Functions
writing tcpdump files: Flags
yield, of a table: Tables
ypserv: portmapper variables

Variable Index

active_conn: activebro
alert_action_filters: alertbro
alert_file: alertbro
anon_log: anonbro
backdoor_demux_disabled: backdoorbro
backdoor_demux_skip_tags: backdoorbro
backdoor_ignore_dst_addrs: backdoorbro
backdoor_ignore_src_addrs: backdoorbro
backdoor_log: backdoorbro
backdoor_min_7bit_ascii_ratio: backdoorbro
backdoor_min_bytes: backdoorbro
backdoor_min_normal_line_ratio: backdoorbro
backdoor_min_num_lines: backdoorbro
preserved_net: anonbro
preserved_subnet: anonbro

Function Index

active_connection: Predefined Functions
root_servers: scanbro

Table of Contents

Bro Reference Manual
1 Introduction
2 Getting Started
- 2.1 Running Bro
- 2.2 Helper utilities
3 Values, Types, and Constants
4 Statements and Expressions
- 4.1 Statements
- 4.2 Expressions
5 Global and Local Variables
- 5.1 Variables Overview
6 Predefined Variables and Functions
- 6.1 Predefined Variables
- 6.2 Predefined Functions
7 Analyzers and Events
8 Signatures
9 Interactive Debugger
10 Missing Documentation
11 References
Index