<div dir="ltr">This ties into something I had noticed recently. Certain scanning tools like to use the same source port per destination IP (I imagine to cache portions of the TCP header). During these scans, multiple TCP connections occur. Bro saw traffic that had:<div>
<br></div><div> - A connection that was setup and torn down as expected (conn_state == "SF")</div><div> - A few minutes pass</div><div> - A second connection that was setup and torn down as expected, *except* that the first SYN was missed - either by Bro or upstream loss.</div>
<div><br></div><div>Bro considered these the same connection.</div><div><br></div><div>Does it makes sense that following a connection teardown, if a SYN-ACK is seen, a new connection begins, instead of using the existing connection? I can probably grab a PCAP if necessary.</div>
<div><br></div><div> --Vlad</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Aug 25, 2014 at 4:32 PM, Jon Siwek (JIRA) <span dir="ltr"><<a href="mailto:jira@bro-tracker.atlassian.net" target="_blank">jira@bro-tracker.atlassian.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
[ <a href="https://bro-tracker.atlassian.net/browse/BIT-1236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel</a> ]<br>
<br>
Jon Siwek updated BIT-1236:<br>
---------------------------<br>
Status: Merge Request (was: Open)<br>
<br>
> topic/jsiwek/flip-on-syn-ack<br>
> ----------------------------<br>
<div class="HOEnZb"><div class="h5">><br>
> Key: BIT-1236<br>
> URL: <a href="https://bro-tracker.atlassian.net/browse/BIT-1236" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1236</a><br>
> Project: Bro Issue Tracker<br>
> Issue Type: Improvement<br>
> Components: Bro<br>
> Affects Versions: git/master<br>
> Reporter: Jon Siwek<br>
> Assignee: Robin Sommer<br>
> Fix For: 2.4<br>
><br>
><br>
> This branch is in bro and bro-testing-private.<br>
> The goal is the same as <a href="https://github.com/bro/bro/pull/11" target="_blank">https://github.com/bro/bro/pull/11</a>, but I have it flip roles at an even earlier point in the code path or else I notice some inconsistencies in things like connection history strings or the connsize analyzer counters (which were probably also issues w/ the old flipping method).<br>
<br>
<br>
<br>
--<br>
This message was sent by Atlassian JIRA<br>
(v6.4-OD-04-006#64001)<br>
_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
</div></div></blockquote></div><br></div>