interconn_conns : table [conn_id] of conn_info
A conn_id
-indexed table of all currently-tracked interactive
connections. The table entries are records
containing some very basic information about the connection.
interconn_log : file
The file into which generic interactive-connection-related alerts are written.
interconn_min_interarrival : interval
Used in computing the “alpha” parameter, which is used to determine which connections are interactive, based on the distribution of interarrival times. See alsointerconn_max_interarrival
.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_max_interarrival : interval
Used in computing the “alpha” parameter, which is used to determine which connections are interactive, based on the distribution of interarrival times. See alsointerconn_max_interarrival
.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_max_keystroke_pkt_size : count
The maximum packet size used to classify keystroke-containing packets.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_default_pkt_size : count
The estimated packet size used to calculate the number of packets missed when we see an ack above a hole. Fixme: Please verify.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_stat_period : interval
How often to generate a report of interconn stats.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_stat_backoff : double
Fixme: I don't fully understand is_expire in timers. The stat report generation interval (interconn_stat_period
) is increased by this factor each time the report is generated [unless the report is generated because all timers are artifically expired].
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_num_pkts : count
A connection must have this number of packets transferred before it may be classified as interactive.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_duration : interval
A connection must last least this long before it may be classified as interactive.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_ssh_len_disabled : bool
If false (default = T), and at least one side of the connection has partial state (the initial negotiation was missed), then packets are examined to see if they fit the size distribution associated with interactive SSH connections.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_ssh_pkts_ratio : double
Analogous tossh_min_ssh_pkts_ratio
, except used in the context described ininterconn_ssh_len_disabiled
.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_bytes : count
The number of bytes transferred on a connection must be at least this high before the connection may be classified as interactive.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_7bit_ascii_ratio : double
The ratio of 7-bit ASCII characters to total bytes must be at least this high before the connection may be classified as interactive.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_num_lines : count
The number of lines transferred on a connection must be at least this high before the connection may be classified as interactive.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_normal_line_ratio : double
The ratio of “normal” lines to total lines must be at least this high before the connection may be classified as interactive. A normal line, roughly speaking, is one whose length is within a certain bound. Fixme: Please verify this.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_alpha : double
The “alpha” parameter computed on connection must be at least this high before the connection may be classified as interactive. This parameter measures certain properties of packet interarrival times. Seeinterconn
.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_min_gamma : double
The “gamme” parameter computed on connection must be at least this high before the connection may be classified as interactive.
interconn_standard_ports : set[port]
Connections to or from these ports are marked as interactive automatically, unlessinterconn_standard_ports
is set to true.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_ignore_standard_ports : bool
If true (default = F), then all connections are analyzed for interactive patterns, regardless of port. Seeinterconn_standard_ports
.
Note: This variable isconst
, so may only be changed viaredef
.
interconn_demux_disabled : bool
If false (default = T), then interactive connections are demuxed when being logged.
Note: This variable isconst
, so may only be changed viaredef
.