Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add policy script to remove ip_proto field, rename protocol naming script

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-08 14:58:37 -07:00
parent 5e5aceb6f7
commit 623fea9014
5 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/protocols/conn/disable-unknown-ip-proto-support.zeek Normal file
View file

@ -0,0 +1,11 @@
##! This script filters the ip_proto field out of the conn.log and disables
##! logging of connections with unknown IP protocols.
@load base/protocols/conn
@load base/frameworks/analyzer/main
redef record Conn::Info$ip_proto -= { &log };
event zeek_init() {
Analyzer::disable_analyzer(PacketAnalyzer::ANALYZER_UNKNOWN_IP_TRANSPORT);
}

4
scripts/policy/protocols/conn/protocol-strings.zeek → scripts/policy/protocols/conn/ip-proto-name-logging.zeek
View file

@ -1,4 +1,6 @@
##! This script adds a string version of the ip_proto field
##! This script adds a string version of the ip_proto field. It's not recommended
##! to load this policy and the ip_proto removal policy at the same time, as
##! conn.log will end up with useless information in the log from this field.
@load base/protocols/conn

3
scripts/test-all-policy.zeek
View file

@ -92,10 +92,11 @@
@load misc/trim-trace-file.zeek
@load misc/unknown-protocols.zeek
@load protocols/conn/community-id-logging.zeek
@load protocols/conn/disable-unknown-ip-proto-support.zeek
@load protocols/conn/ip-proto-name-logging.zeek
@load protocols/conn/known-hosts.zeek
@load protocols/conn/known-services.zeek
@load protocols/conn/mac-logging.zeek
@load protocols/conn/protocol-strings.zeek
@load protocols/conn/vlan-logging.zeek
@load protocols/conn/weirds.zeek
#@load protocols/conn/speculative-service.zeek

2
testing/external/commit-hash.zeek-testing vendored
View file

@ -1 +1 @@
c36d3945546457e5791316ce34947147ba1b0342
0ea51b29a42346c148d93d72b4d7fc7cc7ca50c2

2
testing/external/commit-hash.zeek-testing-private vendored
View file

@ -1 +1 @@
ef56ba5182491ec888eebaa8d4984951fdb40466
7f8f3e6034d10b176f08a12345918e52c74ffef9