next up previous contents index
Next: Generic Connection Analysis Up: Analyzers and Events Previous: Activating an Analyzer   Contents   Index


General Processing Events

Bro provides the following events relating to its overall processing:

[bro_init ()] generated when Bro first starts up. In particular, after Bro has initialized the network (or initialized to read from a save file) and executed any initializations and global statements (§ ), and just before Bro begins to read packets from the network input source(s).

[net_done (t: time)] generated when Bro has finished reading from the network, due to either having exhausted reading the save file(s), or having received a terminating signal (§ ). Deficiency: This event is generated on a terminating signal even if Bro is not reading network traffic. t gives the time at which network processing finished.

This event is generated before bro_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.

[bro_done ()] generated when Bro is about to terminate, either due to having exhausted reading the save file(s), receiving a terminating signal (§ ), or because Bro was run without the network input source and has finished executing any global statements (§ ).

This event is generated after net_done. If you have cleanup that only needs to be done when processing network traffic, it likely is better done using net_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.

[bro_signal (signal: count)] generated when Bro receives a signal. Currently, the signals Bro handles are SIGTERM, SIGINT, and SIGHUP.

Receiving either of the first two terminates Bro, though if Bro is in the middle of processing a set of events, it first finishes with them before shutting down. The shutdown leads to invocations of net_done and bro_done, in that order. Deficiency: In this case, Bro fails to invoke bro_signal, clearly a bug.

Upon receiving SIGHUP, Bro invokes flush_all (in addition to your handler, if any).

[net_stats_update (t: time, ns: net_stats)] This event includes two arguments, t, the time at which the event was generated, and ns, a net_stats record, as defined in Figure [*]. Regarding this second parameter, the pkts_recvd field gives the total number of packets accepted by the packet filter so far during this execution of Bro; pkts_dropped gives the total number of packets reported dropped by the kernel; and interface_drops gives the total number of packets reported by the kernel as having been dropped by the network interface.

Note: An important consideration is that, as shown by experience, the kernel's reporting of these statistics is not always accurate. In particular, the $pkts_dropped statistic is sometimes missing actual packet drops, and some operating systems do not support the interface_drops statistic at all. See the ack_above_hole event for an alternate way to detect if packets are being dropped.

Figure: Definition of the net_stats record.
\begin{figure}\begin{verbatim}type net_stats: record {
...


next up previous contents index
Next: Generic Connection Analysis Up: Analyzers and Events Previous: Activating an Analyzer   Contents   Index
Vern Paxson 2004-03-21