Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Adding support to de-capsulate tunnels.

Browse source 
Checkpoint.
Decapsulation happens after IP Defragmentation. The "identity" of the
enclosing tunnel (the "parent") is added to the connection record of the
child (tunneled) connection as an optional field $tunnel_parent.
This commit is contained in:
Gregor Maier 2011-08-03 14:12:47 -07:00
parent 6c806b0bce
commit 9c388a1809
10 changed files with 183 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ConnCompressor.cc
View file

@ -521,7 +521,7 @@ Connection* ConnCompressor::Instantiate(HashKey* key, PendingConn* pending)
// Fake the first packet.
const IP_Hdr* faked_pkt = PendingConnToPacket(pending);
Connection* new_conn = sessions->NewConn(key, pending->time, &conn_id,
faked_pkt->Payload(), IPPROTO_TCP);
faked_pkt->Payload(), IPPROTO_TCP, 0);
if ( ! new_conn )
{
@ -574,7 +574,7 @@ Connection* ConnCompressor::Instantiate(double t, HashKey* key,
conn_id.dst_port = tp->th_dport;
Connection* new_conn =
sessions->NewConn(key, t, &conn_id, ip->Payload(), IPPROTO_TCP);
sessions->NewConn(key, t, &conn_id, ip->Payload(), IPPROTO_TCP, 0);
if ( ! new_conn )
{