mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
Extendign connection history field to flag when Bro flips a
connection's endpoints. The character is '^'. Addresses BIT-1629.
This commit is contained in:
Robin Sommer
parent
aa33da2775
commit
0c080bca7a
16 changed files with 55 additions and 27 deletions
5
CHANGES
5
CHANGES
|
|
@ -1,4 +1,9 @@
|
|||
|
||||
2.4-683 | 2016-07-08 14:55:04 -0700
|
||||
|
||||
* Extendign connection history field to flag with '^' when Bro flips
|
||||
a connection's endpoints. Addresses BIT-1629. (Robin Sommer)
|
||||
|
||||
2.4-680 | 2016-07-06 09:18:21 -0700
|
||||
|
||||
* Remove ack_above_hole() event, which was a subset of content_gap
|
||||
|
|
|
|||
5
NEWS
5
NEWS
|
|
@ -23,6 +23,11 @@ New Dependencies
|
|||
Log Changes
|
||||
-----------
|
||||
|
||||
- Connections
|
||||
|
||||
- The 'history' field gains a new flag: '^' indicates that Bro
|
||||
heuristically flipped to direction of the connection.
|
||||
|
||||
- DNS
|
||||
|
||||
- New 'rtt' field to indicate the round trip time between when a
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
2.4-680
|
||||
2.4-683
|
||||
|
|
|
|||
|
|
@ -89,6 +89,7 @@ export {
|
|||
## c packet with a bad checksum
|
||||
## i inconsistent packet (e.g. FIN+RST bits set)
|
||||
## q multi-flag packet (SYN+FIN or SYN+RST bits set)
|
||||
## ^ connection direction was flipped by Bro's heuristic
|
||||
## ====== ====================================================
|
||||
##
|
||||
## If the event comes from the originator, the letter is in
|
||||
|
|
|
|||
|
|
@ -773,6 +773,8 @@ void Connection::FlipRoles()
|
|||
root_analyzer->FlipRoles();
|
||||
|
||||
analyzer_mgr->ApplyScheduledAnalyzers(this);
|
||||
|
||||
AddHistory('^');
|
||||
}
|
||||
|
||||
unsigned int Connection::MemoryAllocation() const
|
||||
|
|
|
|||
|
|
@ -1232,6 +1232,9 @@ Connection* NetSessions::NewConn(HashKey* k, double t, const ConnID* id,
|
|||
Connection* conn = new Connection(this, k, t, id, flow_label, pkt, encapsulation);
|
||||
conn->SetTransport(tproto);
|
||||
|
||||
if ( flip )
|
||||
conn->AddHistory('^');
|
||||
|
||||
if ( ! analyzer_mgr->BuildInitialAnalyzerTree(conn) )
|
||||
{
|
||||
conn->Done();
|
||||
|
|
|
|||
10
testing/btest/Baseline/core.history-flip/conn.log
Normal file
10
testing/btest/Baseline/core.history-flip/conn.log
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2016-07-08-21-54-45
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1128727435.633408 CXWv6p3arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 tcp - 1.550793 98 9417 SF - - 0 ^hADdFaf 11 670 10 9945 (empty)
|
||||
#close 2016-07-08-21-54-45
|
||||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-32-33
|
||||
#open 2016-07-08-21-46-16
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1371685686.536606 CXWv6p3arKYeMETxOg 65.65.65.65 19244 65.65.65.65 80 tcp - - - - OTH - - 0 D 1 257 0 0 (empty)
|
||||
1371686961.156859 CjhGID4nQcgTWjvg4c 65.65.65.65 32828 65.65.65.65 80 tcp - - - - OTH - - 0 d 0 0 1 1500 (empty)
|
||||
1371686961.156859 CjhGID4nQcgTWjvg4c 65.65.65.65 32828 65.65.65.65 80 tcp - - - - OTH - - 0 ^d 0 0 1 1500 (empty)
|
||||
1371686961.479321 CCvvfg3TEfuqmmG4bh 65.65.65.65 61193 65.65.65.65 80 tcp - - - - OTH - - 0 D 1 710 0 0 (empty)
|
||||
#close 2015-02-23-21-32-33
|
||||
#close 2016-07-08-21-46-16
|
||||
|
|
|
|||
|
|
@ -3,15 +3,15 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2016-01-15-18-40-13
|
||||
#open 2016-07-08-21-46-30
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1257655301.595604 CIPOse170MGiRM1Qf4 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - - 0 ShADad 10 3605 11 5329 CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585034 CCvvfg3TEfuqmmG4bh 192.168.3.101 53859 216.14.98.22 5072 udp ayiya 20.879001 5129 6109 SF - - 0 Dd 21 5717 13 6473 (empty)
|
||||
1257655293.629048 CXWv6p3arKYeMETxOg 192.168.3.101 53796 216.14.98.22 5072 udp ayiya - - - SHR - - 0 d 0 0 1 176 (empty)
|
||||
1257655293.629048 CXWv6p3arKYeMETxOg 192.168.3.101 53796 216.14.98.22 5072 udp ayiya - - - SHR - - 0 ^d 0 0 1 176 (empty)
|
||||
1257655296.585333 C6pKV8GSxOnSLghOa :: 135 ff02::1:ff00:2 136 icmp - - - - OTH - - 0 - 1 64 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1257655293.629048 CjhGID4nQcgTWjvg4c 2001:4978:f:4c::1 128 2001:4978:f:4c::2 129 icmp - 23.834987 168 56 OTH - - 0 - 3 312 1 104 CXWv6p3arKYeMETxOg,CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585188 CPbrpk1qSsw6ESzHV4 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585151 CRJuHdVW0XPVINV8a fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1257655296.585034 CsRx2w45OKnoww6xl4 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - - 0 - 2 144 0 0 CCvvfg3TEfuqmmG4bh
|
||||
#close 2016-01-15-18-40-13
|
||||
#close 2016-07-08-21-46-30
|
||||
|
|
|
|||
|
|
@ -3,10 +3,10 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2015-02-23-21-33-10
|
||||
#open 2016-07-08-21-46-35
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1333458850.037956 CEle3f3zno26fFZkrh 10.131.112.102 51403 94.245.121.253 3544 udp teredo - - - SHR - - 0 d 0 0 1 84 C3SfNE4BWaU4aSuwkc
|
||||
1333458850.037956 CEle3f3zno26fFZkrh 10.131.112.102 51403 94.245.121.253 3544 udp teredo - - - SHR - - 0 ^d 0 0 1 84 C3SfNE4BWaU4aSuwkc
|
||||
1333458850.040098 CwSkQu4eWZCH7OONC1 174.94.190.229 2152 190.104.181.57 2152 udp gtpv1 0.003698 192 0 S0 - - 0 D 2 248 0 0 (empty)
|
||||
1333458850.016620 CsRx2w45OKnoww6xl4 172.24.16.121 61901 94.245.121.251 3544 udp teredo - - - S0 - - 0 D 1 80 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1333458850.029781 C6pKV8GSxOnSLghOa 172.24.16.67 52298 94.245.121.253 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CPbrpk1qSsw6ESzHV4
|
||||
|
|
@ -18,9 +18,9 @@
|
|||
1333458850.014199 CXWv6p3arKYeMETxOg 174.94.190.213 2152 190.104.181.57 2152 udp gtpv1 - - - S0 - - 0 D 1 124 0 0 (empty)
|
||||
1333458850.040098 CfTOmO0HKorjr8Zp7 172.24.203.81 54447 65.55.158.118 3544 udp teredo 0.003698 120 0 S0 - - 0 D 2 176 0 0 CwSkQu4eWZCH7OONC1
|
||||
1333458850.029783 CIPOse170MGiRM1Qf4 172.24.16.67 52298 65.55.158.118 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CPbrpk1qSsw6ESzHV4
|
||||
1333458850.032887 C7XEbhP654jzLoe3a 10.131.42.160 62069 94.245.121.253 3544 udp teredo - - - SHR - - 0 d 0 0 1 84 CCvvfg3TEfuqmmG4bh
|
||||
1333458850.032887 C7XEbhP654jzLoe3a 10.131.42.160 62069 94.245.121.253 3544 udp teredo - - - SHR - - 0 ^d 0 0 1 84 CCvvfg3TEfuqmmG4bh
|
||||
1333458850.014199 CjhGID4nQcgTWjvg4c 172.24.204.200 56528 65.55.158.118 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CXWv6p3arKYeMETxOg
|
||||
1333458850.035456 CMXxB5GvmoxJFXdTa 172.27.159.9 63912 94.245.121.253 3544 udp teredo - - - S0 - - 0 D 1 89 0 0 CJ3xTn1c4Zw9TmAE05
|
||||
1333458850.016620 CRJuHdVW0XPVINV8a 2001:0:5ef5:79fb:38b8:1695:2b37:be8e 128 2002:2571:c817::2571:c817 129 icmp - - - - OTH - - 0 - 1 52 0 0 CsRx2w45OKnoww6xl4
|
||||
1333458850.035456 Caby8b1slFea8xwSmb fe80::ffff:ffff:fffe 133 ff02::2 134 icmp - 0.000004 0 0 OTH - - 0 - 2 96 0 0 Che1bq3i2rO3KD1Syg,CMXxB5GvmoxJFXdTa
|
||||
#close 2015-02-23-21-33-10
|
||||
#close 2016-07-08-21-46-35
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2016-01-15-18-40-16
|
||||
#open 2016-07-08-21-46-39
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1210953047.736921 CjhGID4nQcgTWjvg4c 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - - 0 fA 1 40 1 40 (empty)
|
||||
1210953050.867067 CCvvfg3TEfuqmmG4bh 192.168.2.16 1577 75.126.203.78 80 tcp - 0.000387 0 0 SHR - - 0 fA 1 40 1 40 (empty)
|
||||
1210953047.736921 CjhGID4nQcgTWjvg4c 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - - 0 ^fA 1 40 1 40 (empty)
|
||||
1210953050.867067 CCvvfg3TEfuqmmG4bh 192.168.2.16 1577 75.126.203.78 80 tcp - 0.000387 0 0 SHR - - 0 ^fA 1 40 1 40 (empty)
|
||||
1210953057.833364 CIPOse170MGiRM1Qf4 192.168.2.16 1577 75.126.203.78 80 tcp - 0.079208 0 0 SH - - 0 Fa 1 40 1 40 (empty)
|
||||
1210953058.007081 CJ3xTn1c4Zw9TmAE05 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTOS0 - - 0 R 1 40 0 0 (empty)
|
||||
1210953057.834454 C7XEbhP654jzLoe3a 192.168.2.16 1578 75.126.203.78 80 tcp http 0.407908 790 171 RSTO - - 0 ShADadR 6 1038 4 335 (empty)
|
||||
|
|
@ -15,16 +15,16 @@
|
|||
1210953058.577231 Caby8b1slFea8xwSmb 192.168.2.16 137 192.168.2.255 137 udp dns 1.499261 150 0 S0 - - 0 D 3 234 0 0 (empty)
|
||||
1210953074.264819 CyAhVIzHqb7t7kv28 192.168.2.16 1920 192.168.2.1 53 udp dns 0.297723 123 598 SF - - 0 Dd 3 207 3 682 (empty)
|
||||
1210953061.312379 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 12.810848 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 C3SfNE4BWaU4aSuwkc
|
||||
1210953076.058333 Cx2FqO23omNawSNrxj 192.168.2.16 1578 75.126.203.78 80 tcp - - - - RSTRH - - 0 r 0 0 1 40 (empty)
|
||||
1210953074.055744 CfTOmO0HKorjr8Zp7 192.168.2.16 1577 75.126.203.78 80 tcp - - - - RSTRH - - 0 r 0 0 1 40 (empty)
|
||||
1210953074.057124 CzA03V1VcgagLjnO92 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTRH - - 0 r 0 0 1 40 (empty)
|
||||
1210953076.058333 Cx2FqO23omNawSNrxj 192.168.2.16 1578 75.126.203.78 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 (empty)
|
||||
1210953074.055744 CfTOmO0HKorjr8Zp7 192.168.2.16 1577 75.126.203.78 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 (empty)
|
||||
1210953074.057124 CzA03V1VcgagLjnO92 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 (empty)
|
||||
1210953074.570439 Cab0vO1xNYSS2hJkle 192.168.2.16 1580 67.228.110.120 80 tcp http 0.466677 469 3916 SF - - 0 ShADadFf 7 757 6 4164 (empty)
|
||||
1210953052.202579 CsRx2w45OKnoww6xl4 192.168.2.16 3797 65.55.158.80 3544 udp teredo 8.928880 129 48 SF - - 0 Dd 2 185 1 76 (empty)
|
||||
1210953060.829233 C3SfNE4BWaU4aSuwkc 192.168.2.16 3797 83.170.1.38 32900 udp teredo 13.293994 2359 11243 SF - - 0 Dd 12 2695 13 11607 (empty)
|
||||
1210953058.933954 Che1bq3i2rO3KD1Syg 0.0.0.0 68 255.255.255.255 67 udp dhcp - - - S0 - - 0 D 1 328 0 0 (empty)
|
||||
1210953052.324629 CPbrpk1qSsw6ESzHV4 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 d 0 0 1 137 (empty)
|
||||
1210953052.324629 CPbrpk1qSsw6ESzHV4 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 ^d 0 0 1 137 (empty)
|
||||
1210953046.591933 CXWv6p3arKYeMETxOg 192.168.2.16 138 192.168.2.255 138 udp - 28.448321 416 0 S0 - - 0 D 2 472 0 0 (empty)
|
||||
1210953052.324629 C6pKV8GSxOnSLghOa fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CPbrpk1qSsw6ESzHV4
|
||||
1210953060.829303 CEle3f3zno26fFZkrh 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - - 0 - 1 52 1 52 C3SfNE4BWaU4aSuwkc,CsRx2w45OKnoww6xl4
|
||||
1210953052.202579 CRJuHdVW0XPVINV8a fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CsRx2w45OKnoww6xl4
|
||||
#close 2016-01-15-18-40-16
|
||||
#close 2016-07-08-21-46-39
|
||||
|
|
|
|||
|
|
@ -3,14 +3,14 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path conn
|
||||
#open 2016-01-15-18-40-17
|
||||
#open 2016-07-08-21-46-55
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
|
||||
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
|
||||
1340127577.354166 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 CRJuHdVW0XPVINV8a
|
||||
1340127577.336558 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 udp teredo 0.010291 129 52 SF - - 0 Dd 2 185 1 80 (empty)
|
||||
1340127577.341510 CRJuHdVW0XPVINV8a 192.168.2.16 3797 83.170.1.38 32900 udp teredo 0.065485 2367 11243 SF - - 0 Dd 12 2703 13 11607 (empty)
|
||||
1340127577.339015 CCvvfg3TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 d 0 0 1 137 (empty)
|
||||
1340127577.339015 CCvvfg3TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 ^d 0 0 1 137 (empty)
|
||||
1340127577.339015 CsRx2w45OKnoww6xl4 fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CCvvfg3TEfuqmmG4bh
|
||||
1340127577.343969 CPbrpk1qSsw6ESzHV4 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - - 0 - 1 52 1 52 CXWv6p3arKYeMETxOg,CRJuHdVW0XPVINV8a
|
||||
1340127577.336558 CjhGID4nQcgTWjvg4c fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CXWv6p3arKYeMETxOg
|
||||
#close 2016-01-15-18-40-17
|
||||
#close 2016-07-08-21-46-56
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@
|
|||
1300475168.90175|CUKS0W3HFYOnBqSE5e|141.142.220.118|56056|141.142.2.2|53|udp|dns|0.000402212142944336|36|131|SF|||0|Dd|1|64|1|159|(empty)
|
||||
1300475168.90219|CRrfvP2lalMAYOCLhj|141.142.220.118|55092|141.142.2.2|53|udp|dns|0.000374078750610352|36|198|SF|||0|Dd|1|64|1|226|(empty)
|
||||
1300475168.90264|Cn78a440HlxuyZKs6f|141.142.220.118|35642|208.80.152.2|80|tcp|http|0.120040893554688|534|412|S1|||0|ShADad|4|750|3|576|(empty)
|
||||
1300475169.78033|CUof3F2yAIid8QS3dk|141.142.220.235|6705|173.192.163.128|80|tcp|||||OTH|||0|h|0|0|1|48|(empty)
|
||||
1300475169.78033|CUof3F2yAIid8QS3dk|141.142.220.235|6705|173.192.163.128|80|tcp|||||OTH|||0|^h|0|0|1|48|(empty)
|
||||
1300475169.89944|CojBOU3CXcLHl1r6x1|141.142.220.44|5353|224.0.0.251|5353|udp|dns||||S0|||0|D|1|85|0|0|(empty)
|
||||
1300475170.86238|CJzVQRGJrX6V15ik7|141.142.220.226|137|141.142.220.255|137|udp|dns|2.61301684379578|350|0|S0|||0|D|7|546|0|0|(empty)
|
||||
1300475171.67537|ClAbxY1nmdjCuo0Le2|fe80::3074:17d5:2052:c324|65373|ff02::1:3|5355|udp|dns|0.100096225738525|66|0|S0|||0|D|2|162|0|0|(empty)
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
BIN
testing/btest/Traces/tcp/missing-syn.pcap
Normal file
BIN
testing/btest/Traces/tcp/missing-syn.pcap
Normal file
Binary file not shown.
2
testing/btest/core/history-flip.bro
Normal file
2
testing/btest/core/history-flip.bro
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
# @TEST-EXEC: bro -C -r $TRACES/tcp/missing-syn.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
Loading…
Add table
Add a link
Reference in a new issue