Bro IDS has built-in network-centric data structures for scripting. For example,
connection is a type of data structure. Question is, where are these structures defined? They are in the file
$BROHOME/policy/bro.init! Here are some examples of pre-defined structures:
type tcp_hdr: record {
sport: port; # source port
dport: port; # destination port
seq: count; # sequence number
ack: count; # acknowledgement number
hl: count; # header length (in bytes)
dl: count; # data length (xxx: not in original tcphdr!)
flags: count; # flags
win: count; # window
};
TCP Header
type ip_hdr: record {
hl: count; # header length (in bytes)
tos: count; # type of service
len: count; # total length
id: count; # identification
ttl: count; # time to live
p: count; # protocol
src: addr; # source address
dst: addr; # dest address
};
IP Header
type udp_hdr: record {
sport: port; # source port
dport: port; # destination port
ulen: count; # udp length
};
UDP Header
type icmp_hdr: record {
icmp_type: count; # type of message
};
ICMP Header
You will notice that Bro have its own data type. In the snippets above, the data types are record, port, count and addr. This built-in data types, combined with the data types makes writing Bro scripts easier since you only have to focus on your scripting logic and flow without worrying too much about the data types and structures. In the next few posts, I will show you how you can write simple Bro IDS scripts.
