Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/vern/content-gap-history'

Browse source 
* origin/topic/vern/content-gap-history:
  Refined state machine update placement to (1) properly deal with gaps capped by clean FIN handshakes, and (1) fix failure to detect split routing.
  added 'g' $history character for content gaps
This commit is contained in:
Jon Siwek 2019-04-22 12:38:06 -07:00
commit d5803d7047
21 changed files with 103 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/protocols/conn/main.zeek
View file

@ -107,6 +107,7 @@ export {
## f packet with FIN bit set
## r packet with RST bit set
## c packet with a bad checksum (applies to UDP too)
## g a content gap
## t packet with retransmitted payload
## w packet with a zero window advertisement
## i inconsistent packet (e.g. FIN+RST bits set)
@ -122,7 +123,7 @@ export {
## 's' can be recorded multiple times for either direction
## if the associated sequence number differs from the
## last-seen packet of the same flag type.
## 'c', 't' and 'w' are recorded in a logarithmic fashion:
## 'c', 'g', 't' and 'w' are recorded in a logarithmic fashion:
## the second instance represents that the event was seen
## (at least) 10 times; the third instance, 100 times; etc.
history: string &log &optional;