Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Added a script module for detecting hosts doing traceroutes.

Browse source
This commit is contained in:
Seth Hall 2012-11-20 01:01:37 -05:00
parent 95b12262e4
commit 47f5d256d8
3 changed files with 97 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/policy/misc/detect-traceroute/detect-low-ttls.sig Normal file
View file

@ -0,0 +1,9 @@
signature traceroute-detector-ipv4 {
header ip[8] < 10
event "match"
}
signature traceroute-detector-ipv6 {
header ip6[7] < 10
event "match"
}