diff --git a/CHANGES b/CHANGES index 9d1631a859..519497d635 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.4-581 | 2016-05-30 10:58:19 -0700 + + * Adding missing new script file mac-logging.bro. (Robin Sommer) + 2.4-580 | 2016-05-29 13:41:10 -0700 * Add Ethernet MAC addresses to connection record. c$eth_src and diff --git a/VERSION b/VERSION index 643581ef57..6bdca7fac6 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4-580 +2.4-581 diff --git a/scripts/policy/protocols/conn/mac-logging.bro b/scripts/policy/protocols/conn/mac-logging.bro new file mode 100644 index 0000000000..a34b955f36 --- /dev/null +++ b/scripts/policy/protocols/conn/mac-logging.bro @@ -0,0 +1,23 @@ +##! This script adds MAC address information to the connection logs. + +@load base/protocols/conn + +module Conn; + +redef record Info += { + ## The Ethernet MAC source address for this connection, if applicable. + eth_src: string &log &optional; + + ## The Ethernet MAC destination address for this connection, if applicable. + eth_dst: string &log &optional; +}; + +event connection_state_remove(c: connection) + { + if ( c?$eth_src ) + c$conn$eth_src = c$eth_src; + + if ( c?$eth_dst ) + c$conn$eth_dst = c$eth_dst; + } +