Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Make conn.log service field ordered

Browse source 
This changes service set in the connection record, and thus also the
conn.log service field to being ordered. Speficically, the order of the
entries in the service field will be the same order in which protocols
will be confirmed. This means that it now is possible to see which
protocols were layered over each other in which order by looking at the
respective conn.log entry.
This commit is contained in:
Johanna Amann 2025-01-23 12:12:23 +00:00
parent c72c1cba6f
commit ac7bbe6949
33 changed files with 44 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/init-bare.zeek
View file

@ -554,7 +554,7 @@ type connection: record {
## principle it is possible that more than one protocol analyzer is able
## to parse the same data. If so, all will be recorded. Also note that
## the recorded services are independent of any transport-level protocols.
service: set[string];
service: set[string] &ordered;
history: string; ##< State history of connections. See *history* in :zeek:see:`Conn::Info`.
## A globally unique connection identifier. For each connection, Zeek
## creates an ID that is very likely unique across independent Zeek runs.