Connections
for TCP are well-defined, because establishing and terminating a connection
plays a central part of the TCP protocol. Beyond those, Bro enforces a hard
connection timeout after the period of time specified through the
tcp_inactivity_timeout
variable, defined in bro.init.
For UDP, a connection begins when host A sends
a packet to host B for the first time, B never having sent anything
to A. This transmission is termed a request, even if in fact
the application protocol being used is not based on requests and replies.
If B sends a packet back, then that packet is termed a reply.
Each packet A or B sends is another request or reply.
UDP connection timeouts are specified through the udp_inactivity_timeout
variable, defined in bro.init.
For ICMP, Bro likewise creates a connection the first time it sees
an ICMP packet from A to B, even if B previously sent a packet
to A, because that earlier packet would have been for a different
transport connection than the ICMP itself—the ICMP will likely
refer to that connection, but it itself is not part of
the connection. For simplicity, this holds even for ICMP ECHOs and
ECHO_REPLYs; if you want to pair them up, you need to do so explicitly
in the policy script.
ICMP connection timeouts are specified through the icmp_inactivity_timeout
variable, defined in bro.init.