Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Remove resp_size from the log. Refactor when we write out to the log a bit. Geodata now works reliably.

Browse source
This commit is contained in:
Vlad Grigorescu 2013-11-05 11:58:00 -05:00
parent 2cf90d986e
commit d108481e73
1 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/base/protocols/ssh/main.bro
View file

@ -37,12 +37,6 @@ export {
client: string &log &optional; client: string &log &optional;
## Software string from the server. ## Software string from the server.
server: string &log &optional; server: string &log &optional;
## Amount of data returned from the server. This is currently
## the only measure of the success heuristic and it is logged to
## assist analysts looking at the logs to make their own
## determination about the success on a case-by-case basis.
resp_size: count &log &default=0;
## Indicate if the SSH session is done being watched. ## Indicate if the SSH session is done being watched.
done: bool &default=F; done: bool &default=F;
}; };
@ -159,12 +153,22 @@ function check_ssh_connection(c: connection, done: bool)
} }
event heuristic_successful_login(c: connection) &priority=-5
{
Log::write(SSH::LOG, c$ssh);
}
event heuristic_failed_login(c: connection) &priority=-5
{
Log::write(SSH::LOG, c$ssh);
}
event connection_state_remove(c: connection) &priority=-5 event connection_state_remove(c: connection) &priority=-5
{ {
if ( c?$ssh ) if ( c?$ssh )
{ {
check_ssh_connection(c, T); check_ssh_connection(c, T);
c$ssh$resp_size = c$resp$size; if ( c$ssh$status == "undetermined" )
Log::write(SSH::LOG, c$ssh); Log::write(SSH::LOG, c$ssh);
} }
} }