Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Refactor IP-in-IP tunnel support.

Browse source 
UDP tunnel support removed for now, to be re-added in specific
analyzers later, but IP-in-IP is now decapsulated recursively
so nested tunnels can be seen and the inner packets get sent
through the IP fragment reassembler if necessary.
This commit is contained in:
Jon Siwek 2012-04-23 13:15:29 -05:00
parent 4062fc1776
commit b51dd191d7
21 changed files with 300 additions and 323 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/policy/frameworks/tunnel.bro
View file

@ -24,9 +24,8 @@
##! is stored as the ``tunnel_parent`` member of :bro:type:`connection`,
##! which is of type :bro:type:`Tunnel::Parent`.
##!
##! *Limitation:* The decapsulated packets are not fed through the
##! defragmenter again and decapsulation happens only on the primary
##! path, i.e., it's not available for the secondary path.
##! *Limitation:* decapsulation happens only on the primary path, i.e.
##! it's not available for the secondary path.
@load base/protocols/conn