diff --git a/src/Conn.cc b/src/Conn.cc index 4f386529d8..dc05b00dc3 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -17,6 +17,7 @@ #include "zeek/analyzer/Analyzer.h" #include "zeek/analyzer/Manager.h" #include "zeek/analyzer/protocol/pia/PIA.h" +#include "zeek/conntuple/Manager.h" #include "zeek/iosource/IOSource.h" #include "zeek/packet_analysis/protocol/ip/SessionAdapter.h" #include "zeek/packet_analysis/protocol/tcp/TCP.h" @@ -202,6 +203,9 @@ const RecordValPtr& Connection::GetVal() { id_val->Assign(3, val_mgr->Port(ntohs(resp_port), prot_type)); id_val->Assign(4, KeyProto()); + // Allow the connection tuple builder to augment the conn_id. + zeek::conntuple_mgr->GetBuilder().FillConnIdVal(key, id_val); + auto orig_endp = make_intrusive(id::endpoint); orig_endp->Assign(0, 0); orig_endp->Assign(1, 0);