Next: , Previous: sshbro, Up: Predefined Variables



6.1.33 stepping.bro

step_log : file
Alerts related to stepping-stone detection go in this file.

display_pairs : table[addr, string] of connection

If <conn> was a login to <dst> propagating a $DISPLAY of <display>, then we make an entry of [<dst>, <display>] = <conn>.

tag_to_conn_map : table[string] of connection

Maps login tags like "Last login ..." to connections.

conn_tag_info : table[conn_id] of tag_info

A table, indexed by connection ID, of the tag_info related to it. Roughly, “tag info” consists of login strings like “Last login” and $DISPLAY variables. Since this information can stay constant across stepping stones, it is used to detect them.

detected_stones : table[addr, port, addr, port, addr, port, addr, port] of count

Indexed by two pairs of connections: (addr,port)->(addr,port) and (addr,port)->(addr,port) that have been detected to be multiple links in a stepping stone chain. The table value is the “score” of the pair of connections; the higher the score, the more likely it is to be a real stepping stone pair. More points are assigned for a timing-based correlation than, say, a $DISPLAY-based correlation.

did_stone_summary : table[addr, port, addr, port, addr, port, addr, port] of count

Basically tracks which suspected stepping stone connection pairs have had alerts generated for them. See detected_stones for the indexing scheme.

stp_delta : interval


Note: This variable is const, so may only be changed via redef.

stp_idle_min : interval


Note: This variable is const, so may only be changed via redef.

stp_ratio_thresh : double

For timing correlations, the proportion of idle times that must match up for the correlation to be considered significant.
Note: This variable is const, so may only be changed via redef.

stp_scale : double


Note: This variable is const, so may only be changed via redef.

stp_common_host_thresh : count


Note: This variable is const, so may only be changed via redef.

stp_random_pair_thresh : count


Note: This variable is const, so may only be changed via redef.

stp_demux_disabled : count


Note: This variable is const, so may only be changed via redef.

skip_clear_ssh_reports : set[addr, string]


Note: This variable is const, so may only be changed via redef.