Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/johanna/pppoe-session-id-logging'

Browse source 
* origin/topic/johanna/pppoe-session-id-logging:
  Update external tests for pppoe-session-id conn.log changes
  PPPoE: add session id logging
This commit is contained in:
Johanna Amann 2025-07-24 07:51:03 +01:00
commit 4399f171ae
15 changed files with 91 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/policy/protocols/conn/pppoe-session-id-logging.zeek Normal file
View file

@ -0,0 +1,27 @@
##! This script adds PPPoE session ID information to the connection log.
@load base/protocols/conn
module Conn;
redef record Info += {
## The PPPoE session id, if applicable for this connection.
pppoe_session_id: count &log &optional;
};
# Add the PPPoE session ID to the Conn::Info structure. We have to do this right
# at the beginning, while we are handling a packet.
event new_connection(c: connection)
{
local session_id = PacketAnalyzer::PPPoE::session_id();
# no session ID
if ( session_id == 0xFFFFFFFF )
return;
# FIXME: remove when GH-4688 is merged
set_conn(c, F);
c$conn$pppoe_session_id = session_id;
}