mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 17:18:20 +00:00
Change doc/ subdir into a git submodule
The docs now live at https://github.com/zeek/zeek-docs
This commit is contained in:
Jon Siwek
parent
0d685efbf5
commit
2ff746fea7
693 changed files with 26 additions and 105609 deletions
|
|
@ -1,14 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/__load__.bro
|
||||
================================
|
||||
|
||||
|
||||
:Imports: :doc:`base/protocols/conn/contents.bro </scripts/base/protocols/conn/contents.bro>`, :doc:`base/protocols/conn/inactivity.bro </scripts/base/protocols/conn/inactivity.bro>`, :doc:`base/protocols/conn/main.bro </scripts/base/protocols/conn/main.bro>`, :doc:`base/protocols/conn/polling.bro </scripts/base/protocols/conn/polling.bro>`, :doc:`base/protocols/conn/thresholds.bro </scripts/base/protocols/conn/thresholds.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
@ -1,63 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/contents.bro
|
||||
================================
|
||||
.. bro:namespace:: Conn
|
||||
|
||||
This script can be used to extract either the originator's data or the
|
||||
responders data or both. By default nothing is extracted, and in order
|
||||
to actually extract data the ``c$extract_orig`` and/or the
|
||||
``c$extract_resp`` variable must be set to ``T``. One way to achieve this
|
||||
would be to handle the :bro:id:`connection_established` event elsewhere
|
||||
and set the ``extract_orig`` and ``extract_resp`` options there.
|
||||
However, there may be trouble with the timing due to event queue delay.
|
||||
|
||||
.. note::
|
||||
|
||||
This script does not work well in a cluster context unless it has a
|
||||
remotely mounted disk to write the content files to.
|
||||
|
||||
:Namespace: Conn
|
||||
:Imports: :doc:`base/utils/files.bro </scripts/base/utils/files.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
======================================================================== ==================================================================
|
||||
:bro:id:`Conn::default_extract`: :bro:type:`bool` :bro:attr:`&redef` If this variable is set to ``T``, then all contents of all
|
||||
connections will be extracted.
|
||||
:bro:id:`Conn::extraction_prefix`: :bro:type:`string` :bro:attr:`&redef` The prefix given to files containing extracted connections as they
|
||||
are opened on disk.
|
||||
======================================================================== ==================================================================
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
========================================== =
|
||||
:bro:type:`connection`: :bro:type:`record`
|
||||
========================================== =
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: Conn::default_extract
|
||||
|
||||
:Type: :bro:type:`bool`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``F``
|
||||
|
||||
If this variable is set to ``T``, then all contents of all
|
||||
connections will be extracted.
|
||||
|
||||
.. bro:id:: Conn::extraction_prefix
|
||||
|
||||
:Type: :bro:type:`string`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``"contents"``
|
||||
|
||||
The prefix given to files containing extracted connections as they
|
||||
are opened on disk.
|
||||
|
||||
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/inactivity.bro
|
||||
==================================
|
||||
.. bro:namespace:: Conn
|
||||
|
||||
Adjust the inactivity timeouts for interactive services which could
|
||||
very possibly have long delays between packets.
|
||||
|
||||
:Namespace: Conn
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
================================================================================== ==================================================================
|
||||
:bro:id:`Conn::analyzer_inactivity_timeouts`: :bro:type:`table` :bro:attr:`&redef` Define inactivity timeouts by the service detected being used over
|
||||
the connection.
|
||||
:bro:id:`Conn::port_inactivity_timeouts`: :bro:type:`table` :bro:attr:`&redef` Define inactivity timeouts based on common protocol ports.
|
||||
================================================================================== ==================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: Conn::analyzer_inactivity_timeouts
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`Analyzer::Tag`] of :bro:type:`interval`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
[Analyzer::ANALYZER_FTP] = 1.0 hr,
|
||||
[Analyzer::ANALYZER_SSH] = 1.0 hr
|
||||
}
|
||||
|
||||
Define inactivity timeouts by the service detected being used over
|
||||
the connection.
|
||||
|
||||
.. bro:id:: Conn::port_inactivity_timeouts
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`port`] of :bro:type:`interval`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
[22/tcp] = 1.0 hr,
|
||||
[513/tcp] = 1.0 hr,
|
||||
[21/tcp] = 1.0 hr,
|
||||
[23/tcp] = 1.0 hr
|
||||
}
|
||||
|
||||
Define inactivity timeouts based on common protocol ports.
|
||||
|
||||
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
:orphan:
|
||||
|
||||
Package: base/protocols/conn
|
||||
============================
|
||||
|
||||
Support for connection (TCP, UDP, or ICMP) analysis.
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/__load__.bro`
|
||||
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/main.bro`
|
||||
|
||||
This script manages the tracking/logging of general information regarding
|
||||
TCP, UDP, and ICMP traffic. For UDP and ICMP, "connections" are to
|
||||
be interpreted using flow semantics (sequence of packets from a source
|
||||
host/port to a destination host/port). Further, ICMP "ports" are to
|
||||
be interpreted as the source port meaning the ICMP message type and
|
||||
the destination port being the ICMP message code.
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/contents.bro`
|
||||
|
||||
This script can be used to extract either the originator's data or the
|
||||
responders data or both. By default nothing is extracted, and in order
|
||||
to actually extract data the ``c$extract_orig`` and/or the
|
||||
``c$extract_resp`` variable must be set to ``T``. One way to achieve this
|
||||
would be to handle the :bro:id:`connection_established` event elsewhere
|
||||
and set the ``extract_orig`` and ``extract_resp`` options there.
|
||||
However, there may be trouble with the timing due to event queue delay.
|
||||
|
||||
.. note::
|
||||
|
||||
This script does not work well in a cluster context unless it has a
|
||||
remotely mounted disk to write the content files to.
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/inactivity.bro`
|
||||
|
||||
Adjust the inactivity timeouts for interactive services which could
|
||||
very possibly have long delays between packets.
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/polling.bro`
|
||||
|
||||
Implements a generic way to poll connections looking for certain features
|
||||
(e.g. monitor bytes transferred). The specific feature of a connection
|
||||
to look for, the polling interval, and the code to execute if the feature
|
||||
is found are all controlled by user-defined callback functions.
|
||||
|
||||
:doc:`/scripts/base/protocols/conn/thresholds.bro`
|
||||
|
||||
Implements a generic API to throw events when a connection crosses a
|
||||
fixed threshold of bytes or packets.
|
||||
|
||||
|
|
@ -1,201 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/main.bro
|
||||
============================
|
||||
.. bro:namespace:: Conn
|
||||
|
||||
This script manages the tracking/logging of general information regarding
|
||||
TCP, UDP, and ICMP traffic. For UDP and ICMP, "connections" are to
|
||||
be interpreted using flow semantics (sequence of packets from a source
|
||||
host/port to a destination host/port). Further, ICMP "ports" are to
|
||||
be interpreted as the source port meaning the ICMP message type and
|
||||
the destination port being the ICMP message code.
|
||||
|
||||
:Namespace: Conn
|
||||
:Imports: :doc:`base/utils/site.bro </scripts/base/utils/site.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Types
|
||||
#####
|
||||
========================================== ===================================================================
|
||||
:bro:type:`Conn::Info`: :bro:type:`record` The record type which contains column fields of the connection log.
|
||||
========================================== ===================================================================
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
========================================== =========================================
|
||||
:bro:type:`Log::ID`: :bro:type:`enum` The connection logging stream identifier.
|
||||
:bro:type:`connection`: :bro:type:`record`
|
||||
========================================== =========================================
|
||||
|
||||
Events
|
||||
######
|
||||
=========================================== ==============================================================
|
||||
:bro:id:`Conn::log_conn`: :bro:type:`event` Event that can be handled to access the :bro:type:`Conn::Info`
|
||||
record as it is sent on to the logging framework.
|
||||
=========================================== ==============================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: Conn::Info
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
ts: :bro:type:`time` :bro:attr:`&log`
|
||||
This is the time of the first packet.
|
||||
|
||||
uid: :bro:type:`string` :bro:attr:`&log`
|
||||
A unique identifier of the connection.
|
||||
|
||||
id: :bro:type:`conn_id` :bro:attr:`&log`
|
||||
The connection's 4-tuple of endpoint addresses/ports.
|
||||
|
||||
proto: :bro:type:`transport_proto` :bro:attr:`&log`
|
||||
The transport layer protocol of the connection.
|
||||
|
||||
service: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
An identification of an application protocol being sent over
|
||||
the connection.
|
||||
|
||||
duration: :bro:type:`interval` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
How long the connection lasted. For 3-way or 4-way connection
|
||||
tear-downs, this will not include the final ACK.
|
||||
|
||||
orig_bytes: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
The number of payload bytes the originator sent. For TCP
|
||||
this is taken from sequence numbers and might be inaccurate
|
||||
(e.g., due to large connections).
|
||||
|
||||
resp_bytes: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
The number of payload bytes the responder sent. See
|
||||
*orig_bytes*.
|
||||
|
||||
conn_state: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
========== ===============================================
|
||||
conn_state Meaning
|
||||
========== ===============================================
|
||||
S0 Connection attempt seen, no reply.
|
||||
S1 Connection established, not terminated.
|
||||
SF Normal establishment and termination. Note that this is the same symbol as for state S1. You can tell the two apart because for S1 there will not be any byte counts in the summary, while for SF there will be.
|
||||
REJ Connection attempt rejected.
|
||||
S2 Connection established and close attempt by originator seen (but no reply from responder).
|
||||
S3 Connection established and close attempt by responder seen (but no reply from originator).
|
||||
RSTO Connection established, originator aborted (sent a RST).
|
||||
RSTR Responder sent a RST.
|
||||
RSTOS0 Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder.
|
||||
RSTRH Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator.
|
||||
SH Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open).
|
||||
SHR Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator.
|
||||
OTH No SYN seen, just midstream traffic (a "partial connection" that was not later closed).
|
||||
========== ===============================================
|
||||
|
||||
local_orig: :bro:type:`bool` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
If the connection is originated locally, this value will be T.
|
||||
If it was originated remotely it will be F. In the case that
|
||||
the :bro:id:`Site::local_nets` variable is undefined, this
|
||||
field will be left empty at all times.
|
||||
|
||||
local_resp: :bro:type:`bool` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
If the connection is responded to locally, this value will be T.
|
||||
If it was responded to remotely it will be F. In the case that
|
||||
the :bro:id:`Site::local_nets` variable is undefined, this
|
||||
field will be left empty at all times.
|
||||
|
||||
missed_bytes: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&default` = ``0`` :bro:attr:`&optional`
|
||||
Indicates the number of bytes missed in content gaps, which
|
||||
is representative of packet loss. A value other than zero
|
||||
will normally cause protocol analysis to fail but some
|
||||
analysis may have been completed prior to the packet loss.
|
||||
|
||||
history: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Records the state history of connections as a string of
|
||||
letters. The meaning of those letters is:
|
||||
|
||||
====== ====================================================
|
||||
Letter Meaning
|
||||
====== ====================================================
|
||||
s a SYN w/o the ACK bit set
|
||||
h a SYN+ACK ("handshake")
|
||||
a a pure ACK
|
||||
d packet with payload ("data")
|
||||
f packet with FIN bit set
|
||||
r packet with RST bit set
|
||||
c packet with a bad checksum (applies to UDP too)
|
||||
t packet with retransmitted payload
|
||||
w packet with a zero window advertisement
|
||||
i inconsistent packet (e.g. FIN+RST bits set)
|
||||
q multi-flag packet (SYN+FIN or SYN+RST bits set)
|
||||
^ connection direction was flipped by Bro's heuristic
|
||||
====== ====================================================
|
||||
|
||||
If the event comes from the originator, the letter is in
|
||||
upper-case; if it comes from the responder, it's in
|
||||
lower-case. The 'a', 'd', 'i' and 'q' flags are
|
||||
recorded a maximum of one time in either direction regardless
|
||||
of how many are actually seen. 'f', 'h', 'r' and
|
||||
's' can be recorded multiple times for either direction
|
||||
if the associated sequence number differs from the
|
||||
last-seen packet of the same flag type.
|
||||
'c', 't' and 'w' are recorded in a logarithmic fashion:
|
||||
the second instance represents that the event was seen
|
||||
(at least) 10 times; the third instance, 100 times; etc.
|
||||
|
||||
orig_pkts: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Number of packets that the originator sent.
|
||||
Only set if :bro:id:`use_conn_size_analyzer` = T.
|
||||
|
||||
orig_ip_bytes: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Number of IP level bytes that the originator sent (as seen on
|
||||
the wire, taken from the IP total_length header field).
|
||||
Only set if :bro:id:`use_conn_size_analyzer` = T.
|
||||
|
||||
resp_pkts: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Number of packets that the responder sent.
|
||||
Only set if :bro:id:`use_conn_size_analyzer` = T.
|
||||
|
||||
resp_ip_bytes: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
Number of IP level bytes that the responder sent (as seen on
|
||||
the wire, taken from the IP total_length header field).
|
||||
Only set if :bro:id:`use_conn_size_analyzer` = T.
|
||||
|
||||
tunnel_parents: :bro:type:`set` [:bro:type:`string`] :bro:attr:`&log` :bro:attr:`&optional`
|
||||
If this connection was over a tunnel, indicate the
|
||||
*uid* values for any encapsulating parent connections
|
||||
used over the lifetime of this inner connection.
|
||||
|
||||
orig_l2_addr: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/conn/mac-logging.bro` is loaded)
|
||||
|
||||
Link-layer address of the originator, if available.
|
||||
|
||||
resp_l2_addr: :bro:type:`string` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/conn/mac-logging.bro` is loaded)
|
||||
|
||||
Link-layer address of the responder, if available.
|
||||
|
||||
vlan: :bro:type:`int` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/conn/vlan-logging.bro` is loaded)
|
||||
|
||||
The outer VLAN for this connection, if applicable.
|
||||
|
||||
inner_vlan: :bro:type:`int` :bro:attr:`&log` :bro:attr:`&optional`
|
||||
(present if :doc:`/scripts/policy/protocols/conn/vlan-logging.bro` is loaded)
|
||||
|
||||
The inner VLAN for this connection, if applicable.
|
||||
|
||||
The record type which contains column fields of the connection log.
|
||||
|
||||
Events
|
||||
######
|
||||
.. bro:id:: Conn::log_conn
|
||||
|
||||
:Type: :bro:type:`event` (rec: :bro:type:`Conn::Info`)
|
||||
|
||||
Event that can be handled to access the :bro:type:`Conn::Info`
|
||||
record as it is sent on to the logging framework.
|
||||
|
||||
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/polling.bro
|
||||
===============================
|
||||
.. bro:namespace:: ConnPolling
|
||||
|
||||
Implements a generic way to poll connections looking for certain features
|
||||
(e.g. monitor bytes transferred). The specific feature of a connection
|
||||
to look for, the polling interval, and the code to execute if the feature
|
||||
is found are all controlled by user-defined callback functions.
|
||||
|
||||
:Namespace: ConnPolling
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
================================================== =====================================
|
||||
:bro:id:`ConnPolling::watch`: :bro:type:`function` Starts monitoring a given connection.
|
||||
================================================== =====================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: ConnPolling::watch
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, callback: :bro:type:`function` (c: :bro:type:`connection`, cnt: :bro:type:`count`) : :bro:type:`interval`, cnt: :bro:type:`count`, i: :bro:type:`interval`) : :bro:type:`void`
|
||||
|
||||
Starts monitoring a given connection.
|
||||
|
||||
|
||||
:c: The connection to watch.
|
||||
|
||||
|
||||
:callback: A callback function that takes as arguments the monitored
|
||||
*connection*, and counter *cnt* that increments each time
|
||||
the callback is called. It returns an interval indicating
|
||||
how long in the future to schedule an event which will call
|
||||
the callback. A negative return interval causes polling
|
||||
to stop.
|
||||
|
||||
|
||||
:cnt: The initial value of a counter which gets passed to *callback*.
|
||||
|
||||
|
||||
:i: The initial interval at which to schedule the next callback.
|
||||
May be ``0secs`` to poll right away.
|
||||
|
||||
|
||||
|
|
@ -1,172 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/protocols/conn/thresholds.bro
|
||||
==================================
|
||||
.. bro:namespace:: ConnThreshold
|
||||
|
||||
Implements a generic API to throw events when a connection crosses a
|
||||
fixed threshold of bytes or packets.
|
||||
|
||||
:Namespace: ConnThreshold
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Types
|
||||
#####
|
||||
========================================================= =
|
||||
:bro:type:`ConnThreshold::Thresholds`: :bro:type:`record`
|
||||
========================================================= =
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
========================================== =
|
||||
:bro:type:`connection`: :bro:type:`record`
|
||||
========================================== =
|
||||
|
||||
Events
|
||||
######
|
||||
===================================================================== ============================================================
|
||||
:bro:id:`ConnThreshold::bytes_threshold_crossed`: :bro:type:`event` Generated for a connection that crossed a set byte threshold
|
||||
:bro:id:`ConnThreshold::packets_threshold_crossed`: :bro:type:`event` Generated for a connection that crossed a set byte threshold
|
||||
===================================================================== ============================================================
|
||||
|
||||
Functions
|
||||
#########
|
||||
======================================================================= ===================================================================================================
|
||||
:bro:id:`ConnThreshold::delete_bytes_threshold`: :bro:type:`function` Deletes a byte threshold for connection sizes.
|
||||
:bro:id:`ConnThreshold::delete_packets_threshold`: :bro:type:`function` Deletes a packet threshold for connection sizes.
|
||||
:bro:id:`ConnThreshold::set_bytes_threshold`: :bro:type:`function` Sets a byte threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||
:bro:id:`ConnThreshold::set_packets_threshold`: :bro:type:`function` Sets a packet threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||
======================================================================= ===================================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: ConnThreshold::Thresholds
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
orig_byte: :bro:type:`set` [:bro:type:`count`] :bro:attr:`&default` = ``{ }`` :bro:attr:`&optional`
|
||||
current originator byte thresholds we watch for
|
||||
|
||||
resp_byte: :bro:type:`set` [:bro:type:`count`] :bro:attr:`&default` = ``{ }`` :bro:attr:`&optional`
|
||||
current responder byte thresholds we watch for
|
||||
|
||||
orig_packet: :bro:type:`set` [:bro:type:`count`] :bro:attr:`&default` = ``{ }`` :bro:attr:`&optional`
|
||||
corrent originator packet thresholds we watch for
|
||||
|
||||
resp_packet: :bro:type:`set` [:bro:type:`count`] :bro:attr:`&default` = ``{ }`` :bro:attr:`&optional`
|
||||
corrent responder packet thresholds we watch for
|
||||
|
||||
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ConnThreshold::bytes_threshold_crossed
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for a connection that crossed a set byte threshold
|
||||
|
||||
|
||||
:c: the connection
|
||||
|
||||
|
||||
:threshold: the threshold that was set
|
||||
|
||||
|
||||
:is_orig: True if the threshold was crossed by the originator of the connection
|
||||
|
||||
.. bro:id:: ConnThreshold::packets_threshold_crossed
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for a connection that crossed a set byte threshold
|
||||
|
||||
|
||||
:c: the connection
|
||||
|
||||
|
||||
:threshold: the threshold that was set
|
||||
|
||||
|
||||
:is_orig: True if the threshold was crossed by the originator of the connection
|
||||
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: ConnThreshold::delete_bytes_threshold
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Deletes a byte threshold for connection sizes.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in bytes to remove.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is removed for packets from originator, otherwhise for packets from responder.
|
||||
|
||||
|
||||
:returns: T on success, F on failure.
|
||||
|
||||
.. bro:id:: ConnThreshold::delete_packets_threshold
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Deletes a packet threshold for connection sizes.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in packets.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is removed for packets from originator, otherwise for packets from responder.
|
||||
|
||||
|
||||
:returns: T on success, F on failure.
|
||||
|
||||
.. bro:id:: ConnThreshold::set_bytes_threshold
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Sets a byte threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||
conn_bytes_threshold_crossed will be raised for each set threshold.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in bytes.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is set for bytes from originator, otherwise for bytes from responder.
|
||||
|
||||
|
||||
:returns: T on success, F on failure.
|
||||
|
||||
.. bro:id:: ConnThreshold::set_packets_threshold
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Sets a packet threshold for connection sizes, adding it to potentially already existing thresholds.
|
||||
conn_packets_threshold_crossed will be raised for each set threshold.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in packets.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is set for packets from originator, otherwise for packets from responder.
|
||||
|
||||
|
||||
:returns: T on success, F on failure.
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue