Context conditions pass the match decision on to various other components of Bro. They are only evaluated if all other conditions have already matched. The following context conditions are defined:
eval
policy functionfunction cond(state: signature_state): bool
. See
\f{fig:signature-state} for the definition of signature_state
.
type signature_state: record { id: string; # ID of the signature conn: connection; # Current connection is_orig: bool; # True if current endpoint is originator payload_size: count; # Payload size of the first pkt of curr. endpoint };
Figure 8.1: Definition of the signature_state
record
ip-options
payload-size
comp_integersame-ip
tcp-state
state-listestablished
(the three-way handshake has already been performed),
originator
(the current data is send by the originator of the
connection), and responder
(the current data is send by the
responder of the connection).