tcp
analyzerThe general tcp
analyzer lets you specify that you're interested in
generic connection analysis for TCP. It
simply @load
's conn
and adds the following
to :
tcp[13] & 0x7 != 0
which instructs Bro to capture all TCP SYN, FIN and RST packets; that is, the control packets that delineate the beginning (SYN) and end (FIN) or abnormal termination (RST) of a connection.