Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/conn-duration-thresholds'

Browse source 
* origin/topic/johanna/conn-duration-thresholds:
  Add duration thresholding to the conn-size analyzer.
This commit is contained in:
Johanna Amann 2019-08-01 13:53:51 -07:00
commit 6fa0f4ac49
16 changed files with 324 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

0
testing/btest/Baseline/core.conn-size-threshold/.stderr Normal file
View file

5
testing/btest/Baseline/core.conn-size-threshold/.stdout
View file

@ -2,11 +2,14 @@
0
0
0
0.0
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
3000
2000
63
50
0.0
triggered duration, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 0.1, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 3000, T
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
@ -14,10 +17,12 @@ triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67,
0
0
0
0.0
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
3000
2000
63
50
0.1
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 63, T

0
testing/btest/Baseline/scripts.base.protocols.conn.threshold-delete/.stderr Normal file
View file

0
testing/btest/Baseline/scripts.base.protocols.conn.threshold-delete/.stdout Normal file
View file

2
testing/btest/Baseline/scripts.base.protocols.conn.threshold/.stdout
View file

@ -1,10 +1,12 @@
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 1, T
triggered duration, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 0.2, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2500, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2700, T
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 1, T
triggered duration, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 0.2, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 52, F

10
testing/btest/core/conn-size-threshold.zeek
View file

@ -1,5 +1,6 @@
# @TEST-EXEC: zeek -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
event connection_established(c: connection)
{
@ -7,6 +8,7 @@ event connection_established(c: connection)
print get_current_conn_bytes_threshold(c$id, F);
print get_current_conn_packets_threshold(c$id, T);
print get_current_conn_packets_threshold(c$id, F);
print get_current_conn_duration_threshold(c$id);
print fmt("Threshold set for %s", cat(c$id));
set_current_conn_bytes_threshold(c$id, 3000, T);
@ -15,10 +17,13 @@ event connection_established(c: connection)
set_current_conn_packets_threshold(c$id, 50, F);
set_current_conn_packets_threshold(c$id, 63, T);
set_current_conn_duration_threshold(c$id, 0.1 secs);
print get_current_conn_bytes_threshold(c$id, T);
print get_current_conn_bytes_threshold(c$id, F);
print get_current_conn_packets_threshold(c$id, T);
print get_current_conn_packets_threshold(c$id, F);
print get_current_conn_duration_threshold(c$id);
}
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
@ -30,3 +35,8 @@ event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: b
{
print "triggered packets", c$id, threshold, is_orig;
}
event conn_duration_threshold_crossed(c: connection, threshold: interval, is_orig: bool)
{
print "triggered duration", c$id, threshold, is_orig;
}

30
testing/btest/scripts/base/protocols/conn/threshold-delete.zeek Normal file
View file

@ -0,0 +1,30 @@
# @TEST-EXEC: zeek -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
#
# This tests that no events are raised once all thresholds have been deleted.
event connection_established(c: connection)
{
ConnThreshold::set_bytes_threshold(c, 1, T);
ConnThreshold::delete_bytes_threshold(c, 1, T);
ConnThreshold::set_duration_threshold(c, 0.1secs);
ConnThreshold::delete_duration_threshold(c, 0.1secs);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered bytes", c$id, threshold, is_orig;
}
event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered packets", c$id, threshold, is_orig;
}
event ConnThreshold::duration_threshold_crossed(c: connection, threshold: interval, is_orig: bool)
{
print "triggered duration", c$id, threshold, is_orig;
}

8
testing/btest/scripts/base/protocols/conn/threshold.zeek
View file

@ -10,6 +10,8 @@ event connection_established(c: connection)
ConnThreshold::set_bytes_threshold(c, 3000, T);
ConnThreshold::delete_bytes_threshold(c, 3000, T);
ConnThreshold::set_bytes_threshold(c, 2000, F);
ConnThreshold::set_duration_threshold(c, 0.1secs);
ConnThreshold::set_duration_threshold(c, 0.2secs);
ConnThreshold::set_packets_threshold(c, 50, F);
ConnThreshold::set_packets_threshold(c, 51, F);
@ -17,6 +19,7 @@ event connection_established(c: connection)
ConnThreshold::delete_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
ConnThreshold::delete_duration_threshold(c, 0.1secs);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
@ -28,3 +31,8 @@ event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count,
{
print "triggered packets", c$id, threshold, is_orig;
}
event ConnThreshold::duration_threshold_crossed(c: connection, threshold: interval, is_orig: bool)
{
print "triggered duration", c$id, threshold, is_orig;
}