Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
Repository files navigation
Extended TCP Analysis
=====================
TCPRS is a TCP traffic analyzer that specializes in the detection
and classification of retransmission and network reordering events.
The following forms of events are available in the TCPRS analyzer:
- Dead connection detection
- TCP option detection
- Retransmission detection and classification
- Limited Transmit and Fast Recovery detection
- Network reordering detection and classification
- RTT and initial RTO measurements
To activate all of the new functionality, load ``jswaro/TCPRS``. To use
the analyzer without the use of any of the provided scripts, you can
enable it inside a ``bro_init`` handler::
event bro_init()
{
TCPRS::EnableTCPRSAnalyzer();
}
Included with the analyzer is a collection of 103 test cases that
are used for iterative design and refinement of the analyzer. Each
test case is used to verify a specific function of the analyzer or
general classification of events.