Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Reference the manual's explanation of originator and responder from conn_id

Browse source
This commit is contained in:
Christian Kreibich 2021-04-09 10:31:56 -07:00
parent 25dcf210b1
commit 768b885791
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/init-bare.zeek
View file

@ -168,6 +168,10 @@ type transport_proto: enum {
## .. note:: It's actually a 5-tuple: the transport-layer protocol is stored as ## .. note:: It's actually a 5-tuple: the transport-layer protocol is stored as
## part of the port values, `orig_p` and `resp_p`, and can be extracted from ## part of the port values, `orig_p` and `resp_p`, and can be extracted from
## them with :zeek:id:`get_port_transport_proto`. ## them with :zeek:id:`get_port_transport_proto`.
##
## .. note:: For explanation of Zeek's "originator" and "responder" terminology,
## see :ref:`the manual's description of the connection record
## <writing-scripts-connection-record>`.
type conn_id: record { type conn_id: record {
orig_h: addr; ##< The originator's IP address. orig_h: addr; ##< The originator's IP address.
orig_p: port; ##< The originator's port number. orig_p: port; ##< The originator's port number.