From 669cfbe1095b27b4b6be3f97b5106e3cbcd359e1 Mon Sep 17 00:00:00 2001 From: Christian Kreibich Date: Mon, 4 Apr 2022 14:06:28 -0700 Subject: [PATCH] Correct origin documentation of the version field in the HTTP log. --- scripts/base/protocols/http/main.zeek | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek index c12da898d5..f54216b0dd 100644 --- a/scripts/base/protocols/http/main.zeek +++ b/scripts/base/protocols/http/main.zeek @@ -43,9 +43,12 @@ export { uri: string &log &optional; ## Value of the "referer" header. The comment is deliberately ## misspelled like the standard declares, but the name used here - ## is "referrer" spelled correctly. + ## is "referrer", spelled correctly. referrer: string &log &optional; - ## Value of the version portion of the request. + ## Value of the version portion of the reply. If you require + ## message-level detail, consider the :zeek:see:`http_request` and + ## :zeek:see:`http_reply` events, which report each message's + ## version string. version: string &log &optional; ## Value of the User-Agent header from the client. user_agent: string &log &optional;