Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add duration thresholding to the conn-size analyzer.

Browse source 
Now, in addition to setting thresholds for bytes and packet, one can set
a threshold for connection duration. Note that the threshold event is
only raised once the next packet in the connection is seen.

This also fixes a small pre-existing bug, in which a bunch of warnings
were raised if someone just used the lower-level functions without going
through the higher-level scripting API.
This commit is contained in:
Johanna Amann 2019-08-01 11:50:14 -07:00
parent 11f90bc9f5
commit 9d489cde20
14 changed files with 306 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

30
testing/btest/scripts/base/protocols/conn/threshold-delete.zeek Normal file
View file

@ -0,0 +1,30 @@
# @TEST-EXEC: zeek -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
#
# This tests that no events are raised once all thresholds have been deleted.
event connection_established(c: connection)
{
ConnThreshold::set_bytes_threshold(c, 1, T);
ConnThreshold::delete_bytes_threshold(c, 1, T);
ConnThreshold::set_duration_threshold(c, 0.1secs);
ConnThreshold::delete_duration_threshold(c, 0.1secs);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered bytes", c$id, threshold, is_orig;
}
event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered packets", c$id, threshold, is_orig;
}
event ConnThreshold::duration_threshold_crossed(c: connection, threshold: interval, is_orig: bool)
{
print "triggered duration", c$id, threshold, is_orig;
}

8
testing/btest/scripts/base/protocols/conn/threshold.zeek
View file

@ -10,6 +10,8 @@ event connection_established(c: connection)
ConnThreshold::set_bytes_threshold(c, 3000, T);
ConnThreshold::delete_bytes_threshold(c, 3000, T);
ConnThreshold::set_bytes_threshold(c, 2000, F);
ConnThreshold::set_duration_threshold(c, 0.1secs);
ConnThreshold::set_duration_threshold(c, 0.2secs);
ConnThreshold::set_packets_threshold(c, 50, F);
ConnThreshold::set_packets_threshold(c, 51, F);
@ -17,6 +19,7 @@ event connection_established(c: connection)
ConnThreshold::delete_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
ConnThreshold::delete_duration_threshold(c, 0.1secs);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
@ -28,3 +31,8 @@ event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count,
{
print "triggered packets", c$id, threshold, is_orig;
}
event ConnThreshold::duration_threshold_crossed(c: connection, threshold: interval, is_orig: bool)
{
print "triggered duration", c$id, threshold, is_orig;
}