base/bif/plugins/Bro_UDP.events.bif.bro

GLOBAL
Namespace:GLOBAL
Source File:/scripts/base/bif/plugins/Bro_UDP.events.bif.bro

Summary

Events

udp_contents: event Generated for UDP packets to pass on their payload.
udp_multiple_checksum_errors: event Generated if a UDP flow crosses a checksum-error threshold, per ‘C’/’c’ history reporting.
udp_reply: event Generated for each packet sent by a UDP flow’s responder.
udp_request: event Generated for each packet sent by a UDP flow’s originator.

Detailed Interface

Events

udp_contents
Type:event (u: connection, is_orig: bool, contents: string)

Generated for UDP packets to pass on their payload. As the number of UDP packets can be very large, this event is normally raised only for those on ports configured in udp_content_delivery_ports_orig (for packets sent by the flow’s originator) or udp_content_delivery_ports_resp (for packets sent by the flow’s responder). However, delivery can be enabled for all UDP request and reply packets by setting udp_content_deliver_all_orig or udp_content_deliver_all_resp, respectively. Note that this event is also raised for all matching UDP packets, including empty ones.

U:The connection record for the corresponding UDP flow.
Is_orig:True if the event is raised for the originator side.
Contents:TODO.

See also: udp_reply, udp_request, udp_session_done, udp_content_deliver_all_orig, udp_content_deliver_all_resp, udp_content_delivery_ports_orig, udp_content_delivery_ports_resp

udp_multiple_checksum_errors
Type:event (u: connection, is_orig: bool, threshold: count)

Generated if a UDP flow crosses a checksum-error threshold, per ‘C’/’c’ history reporting.

U:The connection record for the corresponding UDP flow.
Is_orig:True if the event is raised for the originator side.
Threshold:the threshold that was crossed

See also: udp_reply, udp_request, udp_session_done, tcp_multiple_checksum_errors

udp_reply
Type:event (u: connection)

Generated for each packet sent by a UDP flow’s responder. This a potentially expensive event due to the volume of UDP traffic and should be used with care.

U:The connection record for the corresponding UDP flow.

See also: udp_contents, udp_request, udp_session_done

udp_request
Type:event (u: connection)

Generated for each packet sent by a UDP flow’s originator. This a potentially expensive event due to the volume of UDP traffic and should be used with care.

U:The connection record for the corresponding UDP flow.

See also: udp_contents, udp_reply, udp_session_done


Copyright 2016, The Bro Project. Last updated on December 19, 2018. Created using Sphinx 1.8.2.