Bro: detectiong OS probes

Vern Paxson vern at ee.lbl.gov
Wed Jul 18 00:25:17 PDT 2001


> Lot of OS probes works by sending a combination of flags like
> 
> SFU12, SF12 etc and seeing how the OS behaves. I was wondering how to detect
> these kind of probes using bro .
> 
> I know it can be done easily in the TCPConnection::NextPacket()
> where you have the syn,fin,rst and other flags in separate variables.
> Probably i could look for those pattern call the Weird().
> 
> But is that the way to go about it ? Or should the detection be done
> at the bro-script level.

The right way to do it is either via Weird(), or (better) by introducing
a new event handler, something like:

	event strange_TCP_flag_combo(c: connection, SYN: bool, FIN: bool, RST: bool, ACK: bool, PSH: bool, URG: count)

Your policy script could then decide how to react to specific combinations.

		Vern



More information about the Bro mailing list