Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-618: add "tcp_options" event containing TCP option values

Browse source
This commit is contained in:
Jon Siwek 2019-10-03 18:59:02 -07:00
parent 222e3ad3ea
commit 052feacbda
14 changed files with 269 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

33
scripts/base/init-bare.zeek
View file

@ -296,6 +296,39 @@ type endpoint_stats: record {
endian_type: count;
};
module TCP;
export {
## A TCP Option field parsed from a TCP header.
type Option: record {
## The kind number associated with the option. Other optional fields
## of this record may be set depending on this value.
kind: count;
## The total length of the option in bytes, including the kind byte and
## length byte (if present).
length: count;
## This field is set to the raw option bytes if the kind is not
## otherwise known/parsed. It's also set for known kinds whose length
## was invalid.
data: string &optional;
## Kind 2: Maximum Segment Size.
mss: count &optional;
## Kind 3: Window scale.
window_scale: count &optional;
## Kind 5: Selective ACKnowledgement (SACK). This is a list of 2, 4,
## 6, or 8 numbers with each consecutive pair being a 32-bit
## begin-pointer and 32-bit end pointer.
sack: index_vec &optional;
## Kind 8: 4-byte sender timestamp value.
send_timestamp: count &optional;
## Kind 8: 4-byte echo reply timestamp value.
echo_timestamp: count &optional;
};
## The full list of TCP Option fields parsed from a TCP header.
type OptionList: vector of Option;
}
module GLOBAL;
module Tunnel;
export {
## Records the identity of an encapsulating parent of a tunneled connection.