diff --git a/connection/bro-1.3.2/policy/bro.init b/connection/bro-1.3.2/policy/bro.init index 9d8027c..bb4ed1e 100644 --- a/connection/bro-1.3.2/policy/bro.init +++ b/connection/bro-1.3.2/policy/bro.init @@ -91,6 +91,7 @@ type connection: record { addl: string; hot: count; # how hot; 0 = don't know or not hot history: string; + flow_start: time; }; type SYN_packet: record { diff --git a/connection/bro-1.3.2/policy/conn.bro b/connection/bro-1.3.2/policy/conn.bro index 64dd62a..d32c813 100644 --- a/connection/bro-1.3.2/policy/conn.bro +++ b/connection/bro-1.3.2/policy/conn.bro @@ -200,8 +200,8 @@ function record_connection(f: file, c: connection) local s = c$service == "" ? service_name(c) : c$service; local log_msg = - fmt("%.6f %s %s %s %s %d %d %s %s %s %s", - c$start_time, duration, id$orig_h, id$resp_h, s, + fmt("%.6f %.6f %s %s %s %s %d %d %s %s %s %s", + c$start_time, c$flow_start, duration, id$orig_h, id$resp_h, s, id$orig_p, id$resp_p, conn_size(c$orig, trans), conn_size(c$resp, trans), conn_state(c, trans), flags); diff --git a/connection/bro-1.3.2/src/Conn.cc b/connection/bro-1.3.2/src/Conn.cc index 30c5988..29b9064 100644 --- a/connection/bro-1.3.2/src/Conn.cc +++ b/connection/bro-1.3.2/src/Conn.cc @@ -154,6 +154,7 @@ Connection::Connection(NetSessions* s, HashKey* k, double t, const ConnID* id) sessions = s; key = k; start_time = last_time = t; + flow_start = t; copy_addr(id->src_addr, orig_addr); copy_addr(id->dst_addr, resp_addr); @@ -362,6 +363,7 @@ RecordVal* Connection::BuildConnVal() conn_val->Assign(3, new Val(start_time, TYPE_TIME)); // ### conn_val->Assign(4, new Val(last_time - start_time, TYPE_INTERVAL)); conn_val->Assign(8, new StringVal(history.c_str())); + conn_val->Assign(9, new Val(flow_start, TYPE_TIME)); conn_val->SetOrigin(this); @@ -818,6 +820,7 @@ bool Connection::DoSerialize(SerialInfo* info) const return SERIALIZE(int(proto)) && + SERIALIZE(flow_start) && SERIALIZE(history) && SERIALIZE(hist_seen) && SERIALIZE(start_time) && @@ -883,6 +886,7 @@ bool Connection::DoUnserialize(UnserialInfo* info) int iproto; if ( ! (UNSERIALIZE(&iproto) && + UNSERIALIZE(&flow_start) && UNSERIALIZE(&history) && UNSERIALIZE(&hist_seen) && UNSERIALIZE(&start_time) && diff --git a/connection/bro-1.3.2/src/Conn.h b/connection/bro-1.3.2/src/Conn.h index b33beec..2dec57a 100644 --- a/connection/bro-1.3.2/src/Conn.h +++ b/connection/bro-1.3.2/src/Conn.h @@ -347,6 +347,7 @@ protected: uint32 orig_port, resp_port; // in network order TransportProto proto; double start_time, last_time; + double flow_start; double inactivity_timeout; RecordVal* conn_val; RecordVal* orig_endp;