Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Moved link-layer addresses into endpoints.

Browse source 
The link-layer addresses are now part of the connection endpoints
following the originator-responder-pattern. The addresses are printed
with leading zeros. Additionally link-layer addresses are also extracted
for 802.11 plus RadioTap.
This commit is contained in:
Jan Grashoefer 2016-06-02 01:46:26 +02:00
parent a2423f7d43
commit 50cf694aae
19 changed files with 470 additions and 442 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/init-bare.bro
View file

@ -329,6 +329,8 @@ type endpoint: record {
## The current IPv6 flow label that the connection endpoint is using.
## Always 0 if the connection is over IPv4.
flow_label: count;
## The link-layer address seen in the first packet (if available).
l2_addr: string &optional;
};
## A connection. This is Bro's basic connection type describing IP- and
@ -370,14 +372,6 @@ type connection: record {
## The inner VLAN, if applicable for this connection.
inner_vlan: int &optional;
## The Ethernet MAC source addrees, if applicable for this connection.
## The address is derived from the connection's first packet.
eth_src: string &optional;
## The destination Ethernet MAC addrees, if applicable for this connection.
## The address is derived from the connection's first packet.
eth_dst: string &optional;
};
## Default amount of time a file can be inactive before the file analysis