Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Tuning fragment storage down to 5 minutes in the default tuning.

Browse source
This commit is contained in:
Seth Hall 2011-06-10 14:09:58 -04:00
parent d29ffc759d
commit 999b48e801
2 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
policy/tuning/defaults/__load__.bro
View file

@ -1 +1,2 @@
@load tuning/defaults/remove-high-volume-notices
@load tuning/defaults/remove-high-volume-notices
@load tuning/defaults/packet-fragments

10
policy/tuning/defaults/packet-fragments.bro Normal file
View file

@ -0,0 +1,10 @@
## Capture TCP fragments, but not UDP (or ICMP), since those are a lot more
## common due to high-volume, fragmenting protocols such as NFS :-(.
## This normally isn't used because of the default open packet filter
## but we set it anyway in case the user is using a packet filter.
redef capture_filters += { ["frag"] = "(ip[6:2] & 0x3fff != 0) and tcp" };
## Shorten the fragment timeout from never expiring to expiring fragments after
## five minutes.
redef frag_timeout = 5 min;