diff --git a/scripts/base/protocols/ssl/main.bro b/scripts/base/protocols/ssl/main.bro index 75f7ad7364..5b974222a1 100644 --- a/scripts/base/protocols/ssl/main.bro +++ b/scripts/base/protocols/ssl/main.bro @@ -136,8 +136,10 @@ function finish(c: connection, remove_analyzer: bool) { log_record(c$ssl); if ( remove_analyzer && disable_analyzer_after_detection && c?$ssl && c$ssl?$analyzer_id ) + { disable_analyzer(c$id, c$ssl$analyzer_id); delete c$ssl$analyzer_id; + } } event ssl_client_hello(c: connection, version: count, possible_ts: time, client_random: string, session_id: string, ciphers: index_vec) &priority=5