[
https://bro-tracker.atlassian.net/browse/BIT-1131?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15539#comment-15539
]
Robin Sommer commented on BIT-1131:
-----------------------------------
What would happen if Bro reads from multiple sources
(interfaces/files). The easiest way I can think of would be providing
a built-in function that just provides a list of all of them.
Also, we should probably wait with this until we've settled on how to
handle packet sources in the future. There are a number ideas floating
around, in particular allowing script-land to add/remove sources on
the fly.
> Global Variable Containing Trace Filename
> -----------------------------------------
>
> Key: BIT-1131
> URL: https://bro-tracker.atlassian.net/browse/BIT-1131
> Project: Bro Issue Tracker
> Issue Type: New Feature
> Components: Bro
> Affects Versions: 2.2
> Environment: All. This is a feature for scriptland and is environment
> independent. It only benefits environments using Bro in post processing
> situations.
> Reporter: AK
> Labels: language
>
> It would be nice to have a @PKTSOURCE variable similar to the @FILENAME and
> @DIR variables. Somehow exposing the filename of the pcap being processed is
> the end goal.
> One use case could be dynamically loading scripts with @if statements or
> altering control flow within scripts depending on the name of the pcap file.
> Consider if tcpdump is used to record (and rotate) daily packet captures and
> Bro is used in a post processing manner. Assuming the packet capture is named
> according to the day it was recorded on, it would be rather handy for
> scriptland to behave differently depending on the pcap name. Additionally, it
> would be handy to be able to include the name of the pcap file in log file
> names or log records.
--
This message was sent by Atlassian JIRA
(v6.2-OD-09-036#6252)
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
