Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Correct conn history field documentation

Browse source
This commit is contained in:
Jon Siwek 2018-06-08 10:43:03 -05:00
parent 8bbe84a1b6
commit b51e6f39dd
3 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.5-655 | 2018-06-08 10:43:03 -0500
* Correct conn history field documentation (Corelight)
2.5-652 | 2018-06-07 13:57:23 -0500 2.5-652 | 2018-06-07 13:57:23 -0500
* GH-131: disable krb ticket decryption on non-Linux (Corelight) * GH-131: disable krb ticket decryption on non-Linux (Corelight)

2
VERSION
View file

@ -1 +1 @@
2.5-652 2.5-655

9
scripts/base/protocols/conn/main.bro
View file

@ -95,9 +95,12 @@ export {
## ##
## If the event comes from the originator, the letter is in ## If the event comes from the originator, the letter is in
## upper-case; if it comes from the responder, it's in ## upper-case; if it comes from the responder, it's in
## lower-case. Multiple packets of the same type will only be ## lower-case. The 'a', 'c', 'd', 'i', 'q', and 't' flags are
## noted once (e.g. we only record one "d" in each direction, ## recorded a maximum of one time in either direction regardless
## regardless of how many data packets were seen.) ## of how many are actually seen. However, 'f', 'h', 'r', or
## 's' may be recorded multiple times for either direction and
## only compressed when sharing a sequence number with the
## last-seen packet of the same flag type.
history: string &log &optional; history: string &log &optional;
## Number of packets that the originator sent. ## Number of packets that the originator sent.
## Only set if :bro:id:`use_conn_size_analyzer` = T. ## Only set if :bro:id:`use_conn_size_analyzer` = T.