Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Moved link-layer addresses into endpoints.

Browse source 
The link-layer addresses are now part of the connection endpoints
following the originator-responder-pattern. The addresses are printed
with leading zeros. Additionally link-layer addresses are also extracted
for 802.11 plus RadioTap.
This commit is contained in:
Jan Grashoefer 2016-06-02 01:46:26 +02:00
parent a2423f7d43
commit 50cf694aae
19 changed files with 470 additions and 442 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/Conn.h
View file

@ -3,7 +3,6 @@
#ifndef conn_h
#define conn_h
#include <netinet/ether.h>
#include <sys/types.h>
#include "Dict.h"
@ -291,13 +290,17 @@ protected:
TimerMgr::Tag* conn_timer_mgr;
timer_list timers;
static const int l2_addr_len = 6; // Size of link-layer addresses
IPAddr orig_addr;
IPAddr resp_addr;
uint32 orig_port, resp_port; // in network order
TransportProto proto;
uint32 orig_flow_label, resp_flow_label; // most recent IPv6 flow labels
uint32 vlan, inner_vlan; // VLAN this connection traverses, if available
ether_addr eth_src, eth_dst; // Ethernet MAC addresses, if available
u_char l2_src[l2_addr_len]; // Link-layer addresses, if available
u_char l2_dst[l2_addr_len];
u_char *orig_l2_addr, *resp_l2_addr;
double start_time, last_time;
double inactivity_timeout;
RecordVal* conn_val;