Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve format of conn_state docs

Browse source
This commit is contained in:
Jon Siwek 2019-02-13 16:14:50 -08:00
parent 0790c1c559
commit 8e9dc3c789
4 changed files with 43 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.6-117 | 2019-02-13 16:14:50 -0800
* Improve format of conn_state docs (Jon Siwek, Corelight)
2.6-116 | 2019-02-07 10:32:01 -0600
* GH-208: change invalid subnet expressions to a runtime error (Jon Siwek, Corelight)

2
VERSION
View file

@ -1 +1 @@
2.6-116
2.6-117

2
doc

@ -1 +1 @@
Subproject commit 0083f9004852a1843569b699900d0728ec0137b6
Subproject commit eda3c6f2e8cb82a29f4407e12d51a5acde3e276e

54
scripts/base/protocols/conn/main.bro
View file

@ -37,23 +37,43 @@ export {
## *orig_bytes*.
resp_bytes: count &log &optional;
## ========== ===============================================
## conn_state Meaning
## ========== ===============================================
## S0 Connection attempt seen, no reply.
## S1 Connection established, not terminated.
## SF Normal establishment and termination. Note that this is the same symbol as for state S1. You can tell the two apart because for S1 there will not be any byte counts in the summary, while for SF there will be.
## REJ Connection attempt rejected.
## S2 Connection established and close attempt by originator seen (but no reply from responder).
## S3 Connection established and close attempt by responder seen (but no reply from originator).
## RSTO Connection established, originator aborted (sent a RST).
## RSTR Responder sent a RST.
## RSTOS0 Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder.
## RSTRH Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator.
## SH Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open).
## SHR Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator.
## OTH No SYN seen, just midstream traffic (a "partial connection" that was not later closed).
## ========== ===============================================
## Possible *conn_state* values:
##
## * S0: Connection attempt seen, no reply.
##
## * S1: Connection established, not terminated.
##
## * SF: Normal establishment and termination.
## Note that this is the same symbol as for state S1.
## You can tell the two apart because for S1 there will not be any
## byte counts in the summary, while for SF there will be.
##
## * REJ: Connection attempt rejected.
##
## * S2: Connection established and close attempt by originator seen
## (but no reply from responder).
##
## * S3: Connection established and close attempt by responder seen
## (but no reply from originator).
##
## * RSTO: Connection established, originator aborted (sent a RST).
##
## * RSTR: Responder sent a RST.
##
## * RSTOS0: Originator sent a SYN followed by a RST, we never saw a
## SYN-ACK from the responder.
##
## * RSTRH: Responder sent a SYN ACK followed by a RST, we never saw a
## SYN from the (purported) originator.
##
## * SH: Originator sent a SYN followed by a FIN, we never saw a
## SYN ACK from the responder (hence the connection was "half" open).
##
## * SHR: Responder sent a SYN ACK followed by a FIN, we never saw a
## SYN from the originator.
##
## * OTH: No SYN seen, just midstream traffic (a "partial connection"
## that was not later closed).
conn_state: string &log &optional;
## If the connection is originated locally, this value will be T.