Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Use new_connection instead of connection_state_remove

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-12 12:54:47 -07:00
parent 623fea9014
commit 5a3d16e16f
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/policy/protocols/conn/ip-proto-name-logging.zeek
View file

@ -160,8 +160,10 @@ global protocol_names: table[count] of string = {
[145] = "nsh"
};
event connection_state_remove(c: connection) {
if ( c$conn$ip_proto in protocol_names ) {
event new_connection(c: connection) &priority=5 {
# In case we're the first access
Conn::set_conn(c, F);
if ( c$conn?$ip_proto && c$conn$ip_proto in protocol_names ) {
c$conn$ip_proto_name = protocol_names[c$conn$ip_proto];
} else {
c$conn$ip_proto_name = "unknown";