Bro provides the following events relating to its overall processing:
[net_done (t: time)]
generated when Bro has finished reading from the network,
due to either having exhausted reading the save file(s), or having
received a terminating signal (§
This event is generated before bro_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.
[bro_done ()]
generated when Bro is about to terminate, either due to having exhausted
reading the save file(s), receiving a terminating signal
(§
This event is generated after net_done. If you have cleanup that only needs to be done when processing network traffic, it likely is better done using net_done. Note: If Bro terminates due to an invocation of exit, then this event is not generated.
[bro_signal (signal: count)] generated when Bro receives a signal. Currently, the signals Bro handles are SIGTERM, SIGINT, and SIGHUP.
Receiving either of the first two terminates Bro, though if Bro is in the middle of processing a set of events, it first finishes with them before shutting down. The shutdown leads to invocations of net_done and bro_done, in that order. Deficiency: In this case, Bro fails to invoke bro_signal, clearly a bug.
Upon receiving SIGHUP, Bro invokes flush_all (in addition to your handler, if any).
[net_stats_update (t: time, ns: net_stats)] This event includes two arguments, t, the time at which the event was generated, and ns, a net_stats record, as defined in Figure 7.2. Regarding this second parameter, the pkts_recvd field gives the total number of packets accepted by the packet filter so far during this execution of Bro; pkts_dropped gives the total number of packets reported dropped by the kernel; and interface_drops gives the total number of packets reported by the kernel as having been dropped by the network interface.
Note: An important consideration is that, as shown by experience, the kernel's reporting of these statistics is not always accurate. In particular, the $pkts_dropped statistic is sometimes missing actual packet drops, and some operating systems do not support the interface_drops statistic at all. See the ack_above_hole event for an alternate way to detect if packets are being dropped.