mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Allow to track service violations in conn.log.
This introduces ian options, DPD::track_removed_services_in_connection. It adds failed services to the services column, prefixed with a "-". Alternatively, this commit also adds policy/protocols/conn/failed-services.zeek, which provides the same information in a new column in conn.log.
This commit is contained in:
parent
ac7bbe6949
commit
2f712c3c24
8 changed files with 67 additions and 6 deletions
|
@ -0,0 +1,7 @@
|
|||
# @TEST-DOC: Check if DPD options on violations work.
|
||||
# @TEST-EXEC: zeek -r $TRACES/ftp/ftp-invalid-reply-code.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
|
||||
@load policy/protocols/conn/failed-services
|
||||
|
||||
redef DPD::track_removed_services_in_connection = T;
|
Loading…
Add table
Add a link
Reference in a new issue