Ticket #9 (accepted Task)

Opened 3 years ago

Last modified 3 years ago

Creating a Broccoli event from raw pointers

Reported by: matthias Owned by: kreibich
Priority: Normal Milestone:
Component: Broccoli Version: 1.5.2
Keywords: Cc:

Description

In the Broccoli event callback, it is possible to obtain a raw version of an event by copying the memory range from the ev_start and ev_end pointers in the BroEvMeta struct.

However, there is currently no way to create an event from a raw byte stream. It would be great to have a simple interface that creates a Broccoli event given a pointer pair to contiguous memory range with the raw event.

Attachments

event_42.raw Download (5.1 KB) - added by matthias 3 years ago.
Raw Broccoli Event
event_10.raw Download (4.8 KB) - added by matthias 3 years ago.
Raw Broccoli Event (connection_EOF)

Change History

comment:1 Changed 3 years ago by matthias

  • Version set to 1.5-devel (trunk)

comment:2 Changed 3 years ago by robin

  • Status changed from new to seen

comment:3 Changed 3 years ago by kreibich

  • Status changed from seen to accepted

comment:4 Changed 3 years ago by kreibich

It'd help if I could get some stored serializations of complex events for testing. Matthias, do you have any such files sitting around?

Changed 3 years ago by matthias

Raw Broccoli Event

comment:5 Changed 3 years ago by matthias

I attached a the raw binary version of two events (packet_contents and connection_EOF). If you need more examples, let me know.

Changed 3 years ago by matthias

Raw Broccoli Event (connection_EOF)

comment:6 follow-up: ↓ 7 Changed 3 years ago by kreibich

Experimental support for this feature is now available in the branches/christian/oktoberfest branch as of revision 6593, via the bro_event_send_raw() function.

comment:7 in reply to: ↑ 6 Changed 3 years ago by anonymous

Replying to kreibich:

Experimental support for this feature is now available in the branches/christian/oktoberfest branch as of revision 6593, via the bro_event_send_raw() function.

Great, I'll give it a try.

Note: See TracTickets for help on using tickets.