EarlyBird, or eBird, is our generic collector. The EarlyBird gets the worm. The eBird is designed to be sommoned by inetd and logs all the information to and from the emulator. When loaded, eBird will fork the selected emulator and communicate to it using stdio. This method allows the emulator to be built in anylanguage, and thus increases the number of potential developers.
Using a configuration file, eBird will first look for an emulator for the port that eBird is listening. If there are mutliple emulators for the particular service, eBird will select a random emulator for that service. If there are no emultors for the service, eBird will react to what the client does. If the client does not send any data, eBird will select a random emulator that is "server initated". Otherwise, if the client does send data, eBird will select a random emulator that is "client initiated" and understand the initial client data.
Once a compatable emulator is selected, eBird will record and proxy communications between the emulator and the client. Once the communications is finished, eBird will calculate a hash from only the client side data. If this hash does not match a previous client hash, it will be tagged as a new event. EarlyBird will then alert the admin with a dump of both the client and emulator traffic.