Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Make conn.log service field ordered

Browse source 
This changes service set in the connection record, and thus also the
conn.log service field to being ordered. Speficically, the order of the
entries in the service field will be the same order in which protocols
will be confirmed. This means that it now is possible to see which
protocols were layered over each other in which order by looking at the
respective conn.log entry.
This commit is contained in:
Johanna Amann 2025-01-23 12:12:23 +00:00
parent c72c1cba6f
commit ac7bbe6949
33 changed files with 44 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/conn/main.zeek
View file

@ -27,8 +27,10 @@ export {
id: conn_id &log;
## The transport layer protocol of the connection.
proto: transport_proto &log;
## An identification of an application protocol being sent over
## the connection.
## The identification of the application protocol(s) being sent over
## the connection. Can list more than one protocol separated with
## colons. Protocols listed are in the order in which they are
## confirmed.
service: string &log &optional;
## How long the connection lasted.
##