Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

added 'g' $history character for content gaps

Browse source
This commit is contained in:
Vern Paxson 2019-04-17 14:20:48 -07:00
parent 93d384adeb
commit 915189a06a
13 changed files with 61 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/protocols/conn/main.zeek
View file

@ -107,6 +107,7 @@ export {
## f packet with FIN bit set
## r packet with RST bit set
## c packet with a bad checksum (applies to UDP too)
## g a content gap
## t packet with retransmitted payload
## w packet with a zero window advertisement
## i inconsistent packet (e.g. FIN+RST bits set)
@ -122,7 +123,7 @@ export {
## 's' can be recorded multiple times for either direction
## if the associated sequence number differs from the
## last-seen packet of the same flag type.
## 'c', 't' and 'w' are recorded in a logarithmic fashion:
## 'c', 'g', 't' and 'w' are recorded in a logarithmic fashion:
## the second instance represents that the event was seen
## (at least) 10 times; the third instance, 100 times; etc.
history: string &log &optional;