Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add policy script to remove ip_proto field, rename protocol naming script

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-08 14:58:37 -07:00
parent 5e5aceb6f7
commit 623fea9014
5 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/protocols/conn/disable-unknown-ip-proto-support.zeek Normal file
View file

@ -0,0 +1,11 @@
##! This script filters the ip_proto field out of the conn.log and disables
##! logging of connections with unknown IP protocols.
@load base/protocols/conn
@load base/frameworks/analyzer/main
redef record Conn::Info$ip_proto -= { &log };
event zeek_init() {
Analyzer::disable_analyzer(PacketAnalyzer::ANALYZER_UNKNOWN_IP_TRANSPORT);
}

4
scripts/policy/protocols/conn/protocol-strings.zeek → scripts/policy/protocols/conn/ip-proto-name-logging.zeek
View file

@ -1,4 +1,6 @@
##! This script adds a string version of the ip_proto field
##! This script adds a string version of the ip_proto field. It's not recommended
##! to load this policy and the ip_proto removal policy at the same time, as
##! conn.log will end up with useless information in the log from this field.
@load base/protocols/conn