This repository was archived by the owner on Apr 16, 2021. It is now read-only.

Description
From https://www.bro.org/download/NEWS.bro.html:
"conn.log gained a new field local_resp that works like local_orig, just for the responder address of the connection."
OLD conn.log
fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_cc resp_cc sensorname
NEW Bro 2.4 conn.log with local_resp:
fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_cc resp_cc sensorname