demux
ModuleThe demux utility module provides a single function:
demux_conn (id: conn_id, tag: string, otag: string, rtag: string): bool
id
to a pair of files whose names are constructed
out of tag
, otag
, and rtag
, as follows.
The originator-to-responder direction of the connection goes into a file named:
and the other direction in:<
otag>.<
tag>.<
orig-addr>.<
orig-port>-<
resp-addr>.<
resp-port>
Accordingly, tag can be used to associate a unique label with the pair of files, while otag and rtag provide distinct labels for the two directions.<
rtag>.<
tag>.<
resp-addr>.<
resp-port>-<
orig-addr>.<
orig-port>
If Bro is already demuxing the connection, or if the connection is not active, then nothing happens, and the function returns false. Otherwise, it returns true.
Bro places demuxed streams in a directory defined by the redefinable
global demux_dir
, which defaults in the usual fashion to
open_log_file("xscript")
.
Deficiency:Experience has shown that it would be highly convenient if Bro would demultiplex the entire connection contents into the files, instead of just the part of the connection seen subsequently after the call to demux_conn
. One way to do this would be for demux_conn
to offset the contents in the file by the current stream position, and then to invoke a utility tool that goes through the Bro output trace file and copies the contents up to the current stream position to the front of the file. This utility tool might even be another instance of Bro running with suitable arguments.