udp
analyzerThe general udp
analyzer lets you specify that you're interested in
generic connection analysis for UDP. It
@load
's both hot
and conn
, and defines two event handlers:
udp_request (u: connection)
The analyzer invokes check_hot
with a mode of CONN_ATTEMPTED
and then record_connections
to generate a connection summary
(necessary because Bro does not time out UDP connections, and hence
cannot generate a connection-attempt-failed event).
udp_reply (u: connection)
The analyzer invokes check_hot
with a mode of CONN_ESTABLISHED
and then again with a mode of CONN_FINISHED
to cover the general
case that the reply reflects that the connection was both established and
is now complete. Finally, it invokes to
generate a connection summary.
Note: The standard script does not update capture_filter
to capture UDP traffic. Unlike for TCP, where there is a natural generic
filter that captures only a subset of the traffic, the only natural UDP
filter would be simply to capture all UDP traffic, and that can often be
a huge load.