Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add a VLAN-aware flow tuple implementation.

Browse source 
This is a first "real" implementation of a custom tuple, adding additional
fields over the standard five-tuple.

Includes test cases.
This commit is contained in:
Christian Kreibich 2025-06-13 17:10:05 -07:00 • committed by Arne Welzel
parent a5122b5032
commit 29b0f844c0
16 changed files with 290 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/policy/frameworks/conn_key/vlan_fivetuple.zeek Normal file
View file

@ -0,0 +1,14 @@
##! This script adapts Zeek's connection key to include 802.1Q VLAN and
##! Q-in-Q tags, when available. Zeek normally ignores VLAN tags for connection
##! lookups; this change makes it factor them in and also makes those VLAN tags
##! part of the :zeek:see:`conn_id` record.
redef record conn_id += {
## The outer VLAN for this connection, if applicable.
vlan: int &log &optional;
## The inner VLAN for this connection, if applicable.
inner_vlan: int &log &optional;
};
redef ConnKey::factory = ConnKey::CONNKEY_VLAN_FIVETUPLE;