GH-646: add new "successful_connection_remove" event

And switch Zeek's base scripts over to using it in place of
"connection_state_remove".  The difference between the two is
that "connection_state_remove" is raised for all events while
"successful_connection_remove" excludes TCP connections that were never
established (just SYN packets).  There can be performance benefits
to this change for some use-cases.

There's also a new event called ``connection_successful`` and a new
``connection`` record field named "successful" to help indicate this new
property of connections.
This commit is contained in:
Jon Siwek 2019-11-02 11:12:00 -07:00
parent 75588956fc
commit 31f60853c9
48 changed files with 570 additions and 371 deletions

View file

@ -138,7 +138,7 @@ event radius_message(c: connection, result: RADIUS::Message) &priority=-5
}
}
event connection_state_remove(c: connection) &priority=-5
event successful_connection_remove(c: connection) &priority=-5
{
if ( c?$radius && ! c$radius$logged )
{