next up previous contents index
Next: The hot Analyzer Up: Analyzers and Events Previous: Generic Connection Analysis   Contents   Index

Subsections


Site-specific information

The site analyzer is not actually an analyzer but simply a set of global variables (and one function) used to define a site's basic topological information.


Site variables

The site module defines the following variables, all redefinable:

[local_nets : set[net]] Defines which net's Bro should consider as reflecting a local address.

Default: empty.

[local_16_nets : set[net]] Defines which /16 prefixes Bro should consider as reflecting a local address. Deficiency: Bro currently is inconsistent regarding when it consults local_nets versus local_16_nets, so you should ensure that this variable and the previous one are always consistent.

Default: empty.

[local_24_nets : set[net]] The same, but for /24 addresses.

Default: empty.

[neighbor_nets : set[net]] Defines which net's Bro should consider as reflecting a ``neighbor.'' Neighbors networks can be treated specially in some policies, distinct from other non-local addresses. In particular, drop_address will not drop connectivity to an address belonging to a neighbor.

The notion is somewhat historical, as is the use of ``U'' to mark neighbors in connection summaries (§ ).

Default: empty.

[neighbor_16_nets : set[addr]] Defines which /16 addresses Bro should consider as reflecting a neighbor; the only use of this variable in the standard scripts is that a scan originating from an address with one of these prefixes will not be dropped (§ ). Deficiency: The name is poorly chosen and should be changed to better reflect this use. Deficiency: In addition, this variable should be kept consistent with neighbor_nets, until the fine day when the processing is rectified to only use one variable.

Default: empty.

[neighbor_24_nets : set[net]] The same, but for /24 addresses.

Default: empty.


Site-specific functions

Currently, the site module only defines one function:

[is_local_addr(a: addr): bool ] returns true if the given address belongs to one of the ``local'' networks, false otherwise. Currently, the test is made by masking the address to /16 and /24 and comparing it to local_16_nets and local_24_nets.


next up previous contents index
Next: The hot Analyzer Up: Analyzers and Events Previous: Generic Connection Analysis   Contents   Index
Vern Paxson 2002-11-17