Bro provides the following events relating to its overall processing:
[net_done (t: time)]
generated when Bro has finished reading from the network,
due to either having exhausted reading the save file(s), or having
received a terminating signal (§
This event is generated before bro_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.
[bro_done ()]
generated when Bro is about to terminate, either due to having exhausted
reading the save file(s), receiving a terminating signal
(§
This event is generated after net_done. If you have cleanup that only needs to be done when processing network traffic, it likely is better done using net_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.
[bro_signal (signal: count)] generated when Bro receives a signal. Currently, the signals Bro handles are SIGTERM, SIGINT, and SIGHUP.
Receiving either of the first two terminates Bro, though if Bro is in the middle of processing a set of events, it first finishes with them before shutting down. The shutdown leads to invocations of net_done and bro_done, in that order. Deficiency: In this case, Bro fails to invoke bro_signal, clearly a bug.
Upon receiving SIGHUP, Bro invokes flush_all (in addition to your handler, if any).
[net_stats_update (t: time, ns: net_stats)]
This event includes two arguments, t, the time at which
the event was generated, and ns, a net_stats record,
as defined in Figure . Regarding this second parameter,
the pkts_recvd field gives the total number of packets accepted
by the packet filter so far during this execution of Bro; pkts_dropped
gives the total number of packets reported dropped by the kernel;
and interface_drops gives the total number of packets reported
by the kernel as having been dropped by the network interface.
Note: An important consideration is that, as shown by experience, the kernel's reporting of these statistics is not always accurate. In particular, the $pkts_dropped statistic is sometimes missing actual packet drops, and some operating systems do not support the interface_drops statistic at all. See the ack_above_hole event for an alternate way to detect if packets are being dropped.