Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Software framework stores ports for server software.

Browse source
This commit is contained in:
Bernhard Amann 2011-12-07 12:12:46 -08:00
parent f1e132cd1a
commit 707926aaa4
4 changed files with 49 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/policy/protocols/http/software.bro
View file

@ -25,13 +25,13 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
else
{
if ( name == "SERVER" )
Software::found(c$id, Software::parse(value, c$id$resp_h, SERVER));
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, SERVER));
else if ( name == "X-POWERED-BY" )
Software::found(c$id, Software::parse(value, c$id$resp_h, APPSERVER));
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, APPSERVER));
else if ( name == "MICROSOFTSHAREPOINTTEAMSERVICES" )
{
value = cat("SharePoint/", value);
Software::found(c$id, Software::parse(value, c$id$resp_h, APPSERVER));
Software::found(c$id, Software::parse_with_port(value, c$id$resp_h, c$id$resp_p, APPSERVER));
}
}
}