Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change HTTP's DPD signatures so that each side can trigger the analyzer on its own.

Browse source 
This is to avoid missing large sessions where a single side exceeds
the DPD buffer size. It comes with the trade-off that now the analyzer
can be triggered by anybody controlling one of the endpoints (instead
of both).

Test suite changes are minor, and nothing in "external".

Closes #343.
This commit is contained in:
Robin Sommer 2020-09-08 07:33:36 +00:00
parent a00b712e39
commit 0af57d12b2
6 changed files with 32 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-post-large.log
View file

@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path conn
#open 2019-08-30-13-12-19
#open 2020-09-07-08-40-00
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents speculative_service
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string
1567010592.624680 CHhAvVGS1DHFjwGM9 127.0.0.1 37526 127.0.0.1 80 tcp http 0.008395 61907 60478 SF - - 0 ShADadfF 10 62435 9 60954 - http
1567010639.143657 ClEkJM2Vm5giqnMf4h 127.0.0.1 60644 127.0.0.1 5000 tcp - 0.015853 61917 60478 SF - - 0 ShADadfF 10 62445 9 60954 - http
#close 2019-08-30-13-12-19
1567010639.143657 ClEkJM2Vm5giqnMf4h 127.0.0.1 60644 127.0.0.1 5000 tcp http 0.015853 61917 60478 SF - - 0 ShADadfF 10 62445 9 60954 - http
#close 2020-09-07-08-40-00