Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/christian/gh-846-tcp-duration-docs'

Browse source 
* topic/christian/gh-846-tcp-duration-docs:
  Expand Conn::Info$duration comment to clarify TCP end-of-connection handling
This commit is contained in:
Christian Kreibich 2022-11-30 09:42:00 -08:00
commit 1c381b5531
3 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
5.2.0-dev.393 | 2022-11-30 09:42:00 -0800
* GH-846: Expand Conn::Info$duration comment to clarify TCP end-of-connection handling (Christian Kreibich, Corelight)
5.2.0-dev.391 | 2022-11-30 15:37:57 +0000 5.2.0-dev.391 | 2022-11-30 15:37:57 +0000
* script optimization fixes: (Vern Paxson, Corelight) * script optimization fixes: (Vern Paxson, Corelight)

2
VERSION
View file

@ -1 +1 @@
5.2.0-dev.391 5.2.0-dev.393

12
scripts/base/protocols/conn/main.zeek
View file

@ -30,8 +30,16 @@ export {
## An identification of an application protocol being sent over ## An identification of an application protocol being sent over
## the connection. ## the connection.
service: string &log &optional; service: string &log &optional;
## How long the connection lasted. For 3-way or 4-way connection ## How long the connection lasted.
## tear-downs, this will not include the final ACK. ##
## .. note:: The duration doesn't cover trailing "non-productive"
## TCP packets (i.e., ones not contributing new stream payload)
## once a direction is closed. For example, for regular
## 3-way/4-way connection tear-downs it doesn't include the
## final ACK. The reason is largely historic: this approach
## allows more accurate computation of connection data rates.
## Zeek does however reflect such trailing packets in the
## connection history.
duration: interval &log &optional; duration: interval &log &optional;
## The number of payload bytes the originator sent. For TCP ## The number of payload bytes the originator sent. For TCP
## this is taken from sequence numbers and might be inaccurate ## this is taken from sequence numbers and might be inaccurate