Next: , Previous: identbro, Up: Predefined Variables



6.1.20 interconn.bro

interconn_conns : table [conn_id] of conn_info
A conn_id-indexed table of all currently-tracked interactive connections. The table entries are records containing some very basic information about the connection.

interconn_log : file

The file into which generic interactive-connection-related alerts are written.

interconn_min_interarrival : interval

Used in computing the “alpha” parameter, which is used to determine which connections are interactive, based on the distribution of interarrival times. See also interconn_max_interarrival.
Note: This variable is const, so may only be changed via redef.

interconn_max_interarrival : interval

Used in computing the “alpha” parameter, which is used to determine which connections are interactive, based on the distribution of interarrival times. See also interconn_max_interarrival.
Note: This variable is const, so may only be changed via redef.

interconn_max_keystroke_pkt_size : count

The maximum packet size used to classify keystroke-containing packets.
Note: This variable is const, so may only be changed via redef.

interconn_default_pkt_size : count

The estimated packet size used to calculate the number of packets missed when we see an ack above a hole. Fixme: Please verify.
Note: This variable is const, so may only be changed via redef.

interconn_stat_period : interval

How often to generate a report of interconn stats.
Note: This variable is const, so may only be changed via redef.

interconn_stat_backoff : double

Fixme: I don't fully understand is_expire in timers. The stat report generation interval (interconn_stat_period) is increased by this factor each time the report is generated [unless the report is generated because all timers are artifically expired].
Note: This variable is const, so may only be changed via redef.

interconn_min_num_pkts : count

A connection must have this number of packets transferred before it may be classified as interactive.
Note: This variable is const, so may only be changed via redef.

interconn_min_duration : interval

A connection must last least this long before it may be classified as interactive.
Note: This variable is const, so may only be changed via redef.

interconn_ssh_len_disabled : bool

If false (default = T), and at least one side of the connection has partial state (the initial negotiation was missed), then packets are examined to see if they fit the size distribution associated with interactive SSH connections.
Note: This variable is const, so may only be changed via redef.

interconn_min_ssh_pkts_ratio : double

Analogous to ssh_min_ssh_pkts_ratio, except used in the context described in interconn_ssh_len_disabiled.
Note: This variable is const, so may only be changed via redef.

interconn_min_bytes : count

The number of bytes transferred on a connection must be at least this high before the connection may be classified as interactive.
Note: This variable is const, so may only be changed via redef.

interconn_min_7bit_ascii_ratio : double

The ratio of 7-bit ASCII characters to total bytes must be at least this high before the connection may be classified as interactive.
Note: This variable is const, so may only be changed via redef.

interconn_min_num_lines : count

The number of lines transferred on a connection must be at least this high before the connection may be classified as interactive.
Note: This variable is const, so may only be changed via redef.

interconn_min_normal_line_ratio : double

The ratio of “normal” lines to total lines must be at least this high before the connection may be classified as interactive. A normal line, roughly speaking, is one whose length is within a certain bound. Fixme: Please verify this.
Note: This variable is const, so may only be changed via redef.

interconn_min_alpha : double

The “alpha” parameter computed on connection must be at least this high before the connection may be classified as interactive. This parameter measures certain properties of packet interarrival times. See interconn.
Note: This variable is const, so may only be changed via redef.

interconn_min_gamma : double

The “gamme” parameter computed on connection must be at least this high before the connection may be classified as interactive.

interconn_standard_ports : set[port]

Connections to or from these ports are marked as interactive automatically, unless interconn_standard_ports is set to true.
Note: This variable is const, so may only be changed via redef.

interconn_ignore_standard_ports : bool

If true (default = F), then all connections are analyzed for interactive patterns, regardless of port. See interconn_standard_ports.
Note: This variable is const, so may only be changed via redef.

interconn_demux_disabled : bool

If false (default = T), then interactive connections are demuxed when being logged.
Note: This variable is const, so may only be changed via redef.