mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
FileAnalysis: add binary input reader and BIFs for sending in data.
This allows the input framework to feed files in to Bro for analysis.
This commit is contained in:
parent
c330b46128
commit
00b2d34a8e
14 changed files with 399 additions and 29 deletions
|
@ -51,8 +51,10 @@ export {
|
|||
## from a container file as part of the analysis.
|
||||
parent_file_id: string &log &optional;
|
||||
|
||||
## The network protocol over which the file was transferred.
|
||||
protocol: string &log &optional;
|
||||
## An identification of the source of the file data. E.g. it may be
|
||||
## a network protocol over which it was transferred, or a local file
|
||||
## path which was read, or some other input source.
|
||||
source: string &log &optional;
|
||||
|
||||
## The set of connections over which the file was transferred,
|
||||
## indicated by UID strings.
|
||||
|
|
|
@ -2,4 +2,5 @@
|
|||
@load ./readers/ascii
|
||||
@load ./readers/raw
|
||||
@load ./readers/benchmark
|
||||
@load ./readers/binary
|
||||
|
||||
|
|
8
scripts/base/frameworks/input/readers/binary.bro
Normal file
8
scripts/base/frameworks/input/readers/binary.bro
Normal file
|
@ -0,0 +1,8 @@
|
|||
##! Interface for the binary input reader.
|
||||
|
||||
module InputBinary;
|
||||
|
||||
export {
|
||||
## Size of data chunks to read from the input file at a time.
|
||||
const chunk_size = 1024 &redef;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue