[Bro-Dev] [JIRA] (BIT-76) Low port trolling vs. backscatter

[Jon Siwek (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-76?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16819#comment-16819 ] 

Jon Siwek commented on BIT-76:
------------------------------

{quote}
But Vlad pointed out something interesting about this trace. It seems to cause the get_file_handle event to get generated quite a few times. That really doesn't make any sense to me. Something to look into at some point.
{quote}

I think that's mostly a result of some difficulty in hooking up the current HTTP_Analyzer w/ the FAF --  the protocol analyzer didn't have direct access to particular entities that are in-flight, so HTTP_Analyzer::Done() has a catch-all file_mgr->EndOfFile().  In this case, that means asking the script-layer to return a file handle for the current entity, but that ultimately just ends up saying "I haven't seen anything; there's nothing there".

Agree that it's suboptimal.  I think improving would require changes to HTTP analyzer (or maybe just waiting for the binpac++ version? :)).

> Low port trolling vs. backscatter
> ---------------------------------
>
>                 Key: BIT-76
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-76
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>            Reporter: Vern Paxson
>            Priority: Low
>              Labels: scan
>         Attachments: backscatter.trace
>
>
> Running on the attached trace, mt.bro correctly diagnoses backscatter, but then goes on to later complain about low-port trolling.  Seems this latter should be suppressed, as it's just a follow-on from the backscatter.



--
This message was sent by Atlassian JIRA
(v6.3-OD-06-017#6327)