- ...Laboratory
-
This work was supported by the Director, Office of Energy Research, Office of
Computational and Technology Research, Mathematical, Information, and
Computational Sciences Division of the United States Department of Energy
under Contract No. DE-AC03-76SF00098.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...#NetRanger##1#],
- Or at least appear,
according to their
product literature, to do the same things-we do not have direct
experience with any of these products.
A somewhat different sort of product, the ``Network Flight Recorder,'' is
described in [RLSSLW97, Ne97].
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...too.
-
There is a subtle design decision involved with processing all of the
generated events before proceeding to read the next packet. We might
be tempted to defer event processing until a period of relatively
light activity, to aid the engine with keeping up during periods
of heavy load. However, doing so can lead to races: the ``event control''
arrow in Figure 1 reflects the fact that the policy script
can, to a limited degree, manipulate the connection state maintained
inside the engine. If event processing is deferred, then such control
may happen after the connection state has already been changed due
to more recently-received traffic. So, to ensure that event processing
always reflects fresh data, and does not inadvertently lead to inconsistent
connection state, we process events immediately, before moving on to
newly-arrived network traffic.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...information.
-
Some systems, such as DIDS and CSM, orchestrate multiple monitors
watching multiple network links, in order to track users as they move from
machine to machine [MHL94, WFP96]. These differ from what we envision
for Bro in that they require each host in the network to run a monitor.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
- ...both.
-
We do indeed see occasional multiple requests. So far, they have
all appeared fully innocuous.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
