[Bro-Dev] [JIRA] (BIT-1257) Same file id generated for potentially different files

Seth Hall (JIRA) jira at bro-tracker.atlassian.net
Mon Sep 22 06:55:08 PDT 2014

    [ https://bro-tracker.atlassian.net/browse/BIT-1257?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18201#comment-18201 ] 

Seth Hall commented on BIT-1257:

Unfortunately there isn't a single consistent way to identify file chunks over HTTP and rely on those being from the same file over time.

Take a look at scripts/base/protocols/http/files.bro.  If you look at the get_file_handle handle function defined in that file I point you at you can see our default mechanism for choosing file IDs for files over HTTP.  If you want to replace that with your own, take a look at the bottom of  that file.  You can call the Files::register_protocol function with your own get_file_handle equivalent to make Bro behave in some different way.

> Same file id generated for potentially different files
> ------------------------------------------------------
>                 Key: BIT-1257
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1257
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master, 2.3
>         Environment: CentOS 6
>            Reporter: Jimmy Jones
>         Attachments: fa.bro, sample-samefileid.pcap
> Attached sample contains two HTTP downloads of the same URL from the same client, but there are no guarantees that the files is actually the same (no Etags etc - in this case it actually is the same, but lets pretend they were different...). However the file analysis framework seems to give the same file ID in file_name and file_chunk for both downloads.
> Think this is something to do with Range requests as doesn't happen if do "normal" HTTP requests.

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list