diff --git a/src/Net.cc b/src/Net.cc index 1334aacd44..31ff2fa994 100644 --- a/src/Net.cc +++ b/src/Net.cc @@ -223,7 +223,11 @@ void expire_timers(iosource::PktSrc* src_ps) void net_packet_dispatch(double t, const Packet* pkt, iosource::PktSrc* src_ps) { if ( ! bro_start_network_time ) + { bro_start_network_time = t; + if ( network_time_init ) + mgr.Enqueue(network_time_init, zeek::Args{}); + } // network_time never goes back. net_update_time(timer_mgr->Time() < t ? t : timer_mgr->Time()); diff --git a/src/event.bif b/src/event.bif index 8927aefa2c..57afa2be6b 100644 --- a/src/event.bif +++ b/src/event.bif @@ -35,7 +35,7 @@ ## one-time initialization code at startup. At the time a handler runs, Zeek will ## have executed any global initializations and statements. ## -## .. zeek:see:: zeek_done +## .. zeek:see:: zeek_done, network_time_init ## ## .. note:: ## @@ -61,6 +61,14 @@ event zeek_init%(%); ## is not generated. event zeek_done%(%); +## Generated when network time is initialized. The event engine generates this +## event after the network time has been determined but before processing of +## packets is started. +## +## .. zeek:see:: zeek_init, network_time +## +event network_time_init%(%); + ## Generated for every new connection. This event is raised with the first ## packet of a previously unknown connection. Zeek uses a flow-based definition ## of "connection" here that includes not only TCP sessions but also UDP and