mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
GH-646: add new "successful_connection_remove" event
And switch Zeek's base scripts over to using it in place of "connection_state_remove". The difference between the two is that "connection_state_remove" is raised for all events while "successful_connection_remove" excludes TCP connections that were never established (just SYN packets). There can be performance benefits to this change for some use-cases. There's also a new event called ``connection_successful`` and a new ``connection`` record field named "successful" to help indicate this new property of connections.
This commit is contained in:
parent
75588956fc
commit
31f60853c9
48 changed files with 570 additions and 371 deletions
|
@ -182,7 +182,7 @@ event ProtocolDetector::check_connection(c: connection)
|
|||
}
|
||||
}
|
||||
|
||||
event connection_state_remove(c: connection)
|
||||
event successful_connection_remove(c: connection)
|
||||
{
|
||||
if ( c$id !in conns )
|
||||
{
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue