Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'empty_services' of https://github.com/mauropalumbo75/zeek

Browse source 
* 'empty_services' of https://github.com/mauropalumbo75/zeek:
  remove empty services and include udp active connections when logging in connection_state_remove
This commit is contained in:
Jon Siwek 2019-08-09 09:56:06 -07:00
commit a68c9f6b71
5 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/policy/protocols/conn/known-services.zeek
View file

@ -210,7 +210,10 @@ event connection_state_remove(c: connection) &priority=-5
if ( c$known_services_done )
return;
if ( c$resp$state != TCP_ESTABLISHED )
if ( c$resp$state != TCP_ESTABLISHED && c$resp$state != UDP_ACTIVE )
return;
if ( |c$service| == 0 )
return;
known_services_done(c);