base/frameworks/netcontrol/shunt.bro

NetControl

Implementation of the shunt functionality for NetControl.

Namespace:NetControl Imports:base/frameworks/netcontrol/main.bro Source File:/scripts/base/frameworks/netcontrol/shunt.bro

Summary

Types

NetControl::ShuntInfo: record

Redefinitions

Log::ID: enum

Events

NetControl::log_netcontrol_shunt: event

Event that can be handled to access the NetControl::ShuntInfo record as it is sent on to the logging framework.

Functions

NetControl::shunt_flow: function

Stops forwarding a uni-directional flow’s packets to Bro.

Detailed Interface

Types

NetControl::ShuntInfo

Type:

record

ts: time &log

Time at which the recorded activity occurred.

rule_id: string &log

ID of the rule; unique during each Bro run.

f: flow_id &log

Flow ID of the shunted flow.

expire: interval &log

Expiry time of the shunt.

location: string &log &optional

Location where the underlying action was triggered.

Events

NetControl::log_netcontrol_shunt

Type:event (rec: NetControl::ShuntInfo)

Event that can be handled to access the NetControl::ShuntInfo record as it is sent on to the logging framework.

Functions

NetControl::shunt_flow

Type:function (f: flow_id, t: interval, location: string &default = "" &optional) : string

Stops forwarding a uni-directional flow’s packets to Bro.

F:The flow to shunt. T:How long to leave the shunt in place, with 0 being indefinitely. Location:An optional string describing where the shunt was triggered. Returns:The id of the inserted rule on success and zero on failure.