Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Extendign connection history field to flag when Bro flips a

Browse source 
connection's endpoints.

The character is '^'.

Addresses BIT-1629.
This commit is contained in:
Robin Sommer 2016-07-08 12:45:02 -07:00
parent aa33da2775
commit 0c080bca7a
16 changed files with 55 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/conn/main.bro
View file

@ -89,6 +89,7 @@ export {
## c packet with a bad checksum
## i inconsistent packet (e.g. FIN+RST bits set)
## q multi-flag packet (SYN+FIN or SYN+RST bits set)
## ^ connection direction was flipped by Bro's heuristic
## ====== ====================================================
##
## If the event comes from the originator, the letter is in