Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Convert more redef-able constants to runtime options

Browse source
This commit is contained in:
Daniel Thayer 2018-08-24 16:05:44 -05:00
parent 4912513517
commit 01a899255e
36 changed files with 72 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/policy/frameworks/dpd/detect-protocols.bro
View file

@ -21,7 +21,7 @@ export {
type dir: enum { NONE, INCOMING, OUTGOING, BOTH };
const valids: table[Analyzer::Tag, addr, port] of dir = {
option valids: table[Analyzer::Tag, addr, port] of dir = {
# A couple of ports commonly used for benign HTTP servers.
# For now we want to see everything.
@ -37,23 +37,23 @@ export {
# [Analyzer::ANALYZER_HTTP, 0.0.0.0, 6346/tcp] = BOTH, # Gnutella
# [Analyzer::ANALYZER_HTTP, 0.0.0.0, 6347/tcp] = BOTH, # Gnutella
# [Analyzer::ANALYZER_HTTP, 0.0.0.0, 6348/tcp] = BOTH, # Gnutella
} &redef;
};
# Set of analyzers for which we suppress Server_Found notices
# (but not Protocol_Found). Along with avoiding clutter in the
# log files, this also saves memory because for these we don't
# need to remember which servers we already have reported, which
# for some can be a lot.
const suppress_servers: set [Analyzer::Tag] = {
option suppress_servers: set [Analyzer::Tag] = {
# Analyzer::ANALYZER_HTTP
} &redef;
};
# We consider a connection to use a protocol X if the analyzer for X
# is still active (i) after an interval of minimum_duration, or (ii)
# after a payload volume of minimum_volume, or (iii) at the end of the
# connection.
const minimum_duration = 30 secs &redef;
const minimum_volume = 4e3 &redef; # bytes
option minimum_duration = 30 secs;
option minimum_volume = 4e3; # bytes
# How often to check the size of the connection.
const check_interval = 5 secs;