mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
Add MAC addresses to connection record.
c$eth_src and c$eth_dst now contain the Ethernet address if available. A new script protocols/conn/mac-logging.bro adds these to conn.log when loaded.
This commit is contained in:
parent
35686fb93a
commit
57aef6d49f
20 changed files with 486 additions and 321 deletions
|
@ -3,6 +3,7 @@
|
|||
#ifndef conn_h
|
||||
#define conn_h
|
||||
|
||||
#include <netinet/ether.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
#include "Dict.h"
|
||||
|
@ -56,7 +57,7 @@ namespace analyzer { class Analyzer; }
|
|||
class Connection : public BroObj {
|
||||
public:
|
||||
Connection(NetSessions* s, HashKey* k, double t, const ConnID* id,
|
||||
uint32 flow, uint32 vlan, uint32 inner_vlan, const EncapsulationStack* arg_encap);
|
||||
uint32 flow, const Packet* pkt, const EncapsulationStack* arg_encap);
|
||||
virtual ~Connection();
|
||||
|
||||
// Invoked when an encapsulation is discovered. It records the
|
||||
|
@ -296,6 +297,7 @@ protected:
|
|||
TransportProto proto;
|
||||
uint32 orig_flow_label, resp_flow_label; // most recent IPv6 flow labels
|
||||
uint32 vlan, inner_vlan; // VLAN this connection traverses, if available
|
||||
ether_addr eth_src, eth_dst; // Ethernet MAC addresses, if available
|
||||
double start_time, last_time;
|
||||
double inactivity_timeout;
|
||||
RecordVal* conn_val;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue