Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/seth/smb

Browse source 
# Conflicts:
#	scripts/site/local.bro
This commit is contained in:
Seth Hall 2016-06-14 15:35:05 -04:00
commit 56a24bdef6
80 changed files with 8168 additions and 458 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/policy/protocols/conn/mac-logging.bro Normal file
View file

@ -0,0 +1,24 @@
##! This script adds link-layer address (MAC) information to the connection logs
@load base/protocols/conn
module Conn;
redef record Info += {
## Link-layer address of the originator, if available.
orig_l2_addr: string &log &optional;
## Link-layer address of the responder, if available.
resp_l2_addr: string &log &optional;
};
# Add the link-layer addresses to the Conn::Info structure after the connection
# has been removed. This ensures it's only done once, and is done before the
# connection information is written to the log.
event connection_state_remove(c: connection)
{
if ( c$orig?$l2_addr )
c$conn$orig_l2_addr = c$orig$l2_addr;
if ( c$resp?$l2_addr )
c$conn$resp_l2_addr = c$resp$l2_addr;
}