forked from jswaro/tcprs
-
Notifications
You must be signed in to change notification settings - Fork 0
TCP Retransmission and State Analyzer plugin for the Bro-IDS framework
License
jsiwek/tcprs
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
Extended TCP Analysis
=====================
TCPRS is a TCP traffic analyzer that specializes in the detection
and classification of retransmission and network reordering events.
The following forms of events are available in the TCPRS analyzer:
- Dead connection detection
- TCP option detection
- Retransmission detection and classification
- Limited Transmit and Fast Recovery detection
- Network reordering detection and classification
- RTT and initial RTO measurements
To activate all of the new functionality, load ``jswaro/TCPRS``. To use
the analyzer without the use of any of the provided scripts, you can
enable it inside a ``bro_init`` handler::
event bro_init()
{
TCPRS::EnableTCPRSAnalyzer();
}
Included with the analyzer is a collection of 103 test cases that
are used for iterative design and refinement of the analyzer. Each
test case is used to verify a specific function of the analyzer or
general classification of events.
About
TCP Retransmission and State Analyzer plugin for the Bro-IDS framework
Resources
License
Stars
Watchers
Forks
Packages 0
No packages published
Languages
- C++ 70.8%
- Zeek 27.2%
- Other 2.0%