next up previous contents index
Next: The dns Module Up: Analyzers and Events Previous: The active Module   Contents   Index


The demux Module

The demux utility module provides a single function:

[demux_conn(id: conn_id, tag: string, otag: string, rtag: string): bool ] Instructs Bro to write (``demultiplex'') the contents of the connection with the given id to a pair of files whose names are constructed out of tag, otag, and rtag, as follows.

The originator-to-responder direction of the connection goes into a file named:

<otag>.< tag>.< orig-addr>.< orig-port>-< resp-addr>.< resp-port>
and the other direction in:
<rtag>.< tag>.< resp-addr>.< resp-port>-< orig-addr>.< orig-port>
Accordingly, tag can be used to associate a unique label with the pair of files, while otag and rtag provide distinct labels for the two directions.

If Bro is already demuxing the connection, or if the connection is not active, then nothing happens, and the function returns false. Otherwise, it returns true.

Bro places demuxed streams in a directory defined by the redefinable global demux_dir, which defaults in the usual fashion to open_log_file("xscript").

Deficiency: Experience has shown that it would be highly convenient if Bro would demultiplex the entire connection contents into the files, instead of just the part of the connection seen subsequently after the call to demux_conn. One way to do this would be for demux_conn to offset the contents in the file by the current stream position, and then to invoke a utility tool that goes through the Bro output trace file (§ ) and copies the contents up to the current stream position to the front of the file. This utility tool might even be another instance of Bro running with suitable arguments.


next up previous contents index
Next: The dns Module Up: Analyzers and Events Previous: The active Module   Contents   Index
Vern Paxson 2002-11-17