[Bro] question about event http_stats
yasein.nk at gmail.com
Sun May 2 08:26:57 PDT 2010
I mean in the $brohome /share/bro/ folder, the http.bro file. It have
an event handler for the http_stats event. But made invalid using "#".
I thought it was because stats$num_requests is 0. But get over it.
On Sun, May 2, 2010 at 4:43 AM, Vern Paxson <vern at icir.org> wrote:
>> #global http_stats: event(c: connection, stats: http_stats_rec);
>> the http_stats event, I think it is raised when one http session is
>> done? But why
>> the stats$num_requests can be 0?
> I would expect (and looking briefly at the code this appears to be true)
> that an http_stats event is generated whenever an HTTP connection finishes,
> even if nothing happened during the connection (no GET request, just a
> SYN handshake). If so, then it would make sense that such unproductive
> sessions have $num_requests equal to 0.
>> I noticed in the http.bro, there is one handler for this event but
>> then annotated.
> I'm not following this comment ...
More information about the Bro