Previous: wormbro, Up: Predefined Variables



6.1.38 Uncategorized

Fixme: These need categorization.

bro_log_file : file
Used to record the messages logged by log statements.

Default: stderr, unless you @load the log analyzer; see XXX for further discussion.

capture_filter : string

Specifies what packets Bro's filter should record .

direct_login_prompts : set[string]

Strings that when seen in a login dialog indicate that the user will be directly logged in after entering their username, without requiring a password (See XXX).

discarder_maxlen : int

The maximum amount of data that Bro should pass to a TCP or UDP discarder (See XXX).
Default: 128 bytes.

done_with_network : bool

Set to true when Bro is done reading from the network (or from the save files being played back, per XXX). The variable is set by a handler for net_done.
Default: initially set to false.

interfaces : string

A blank-separated list of network interfaces from which Bro should read network traffic. Bro merges packets from the interfaces according to their timestamps. Deficiency: All interfaces must have the same link layer type.

If empty, then Bro does not read any network traffic, unless one or more interfaces are specified using the -i flag.

Note: interfaces has an &add_func that allows you to add interfaces to the list simply using a += initialization (See XXX).


Default: empty.

max_timer_expires : count

Sets an upper limit on how many pending timers Bro will expire per newly arriving packet. If set to 0, then Bro expires all pending timers whose time has come or past. This variable trades off timer accuracy and memory requirements (because a number of Bro's internal timers relate to expiring state) with potentially bursty load spikes due to a lot of timers expiring at the same time, which can trigger the watchdog, if active.

restrict_filter : string

Restricts what packets Bro's filter should record (See XXX).