Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 17:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

BIT-1924: add DHCP port to software.log for completeness

Browse source
This commit is contained in:
Jon Siwek 2018-08-16 16:07:14 -05:00
parent 81a8961f16
commit 7fdf621a1d
4 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/dhcp/main.bro
View file

@ -41,6 +41,13 @@ export {
## IP address.
server_addr: addr &log &optional;
## Client port number seen at time of server handing out IP (expected
## as 68/udp).
client_port: port &optional;
## Server port number seen at time of server handing out IP (expected
## as 67/udp).
server_port: port &optional;
## Client's hardware address.
mac: string &log &optional;
@ -224,6 +231,8 @@ event DHCP::aggregate_msgs(ts: time, id: conn_id, uid: string, is_orig: bool, ms
id$resp_h != 255.255.255.255 )
{
log_info$server_addr = id$resp_h;
log_info$server_port = id$resp_p;
log_info$client_port = id$orig_p;
}
# Only use the client hardware address from the server