From 040068f390ce39e3bbf475daf0b74a04e98be70b Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 10 Jan 2024 15:36:12 +0100 Subject: [PATCH] NEWS: Update news for tunnel depth changes --- NEWS | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS b/NEWS index 0b9871f966..29bbedeac3 100644 --- a/NEWS +++ b/NEWS @@ -153,6 +153,10 @@ New Functionality Note that generally you should prefer record extension in conditionally loaded scripts rather than using conditional directives in the original record definition. +- The 'X' code can now appear in a connection's history. It is meant to indicate + situations where Zeek stopped analyzing traffic due to exceeding certain limits or + when encountering unknown/unsupported protocols. Its first use is to indicate + ``Tunnel::max_depth`` being exceeded. Changed Functionality --------------------- @@ -172,6 +176,10 @@ Changed Functionality detail API from ``digest.h`` to compute hashes likely need to accommodate for this change. +- The ``Tunnel::max_depth`` default was changed from 2 to 4 allowing for more than + two encapsulation layers. Two layers are already easily reached in AWS GLB + environments. + Removed Functionality ---------------------