Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add high level api for thresholding that holds lists of thresholds

Browse source 
and raises an event for each threshold exactly once.
This commit is contained in:
Johanna Amann 2015-04-16 15:36:48 -07:00
parent 9290718bd6
commit d876c044df
9 changed files with 381 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/Baseline/scripts.base.protocols.conn.threshold/.stdout Normal file
View file

@ -0,0 +1,10 @@
Threshold set for [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp]
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 1, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2000, F
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2500, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 2700, T
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 50, F
Threshold set for [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp]
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 1, T
triggered bytes, [orig_h=192.168.1.77, orig_p=57655/tcp, resp_h=209.197.168.151, resp_p=1024/tcp], 2000, F
triggered packets, [orig_h=192.168.1.77, orig_p=57640/tcp, resp_h=66.198.80.67, resp_p=6667/tcp], 52, F

24
testing/btest/core/conn-size-threshold.bro
View file

@ -3,22 +3,22 @@
event connection_established(c: connection)
{
print get_conn_bytes_threshold(c$id, T);
print get_conn_bytes_threshold(c$id, F);
print get_conn_packets_threshold(c$id, T);
print get_conn_packets_threshold(c$id, F);
print get_current_conn_bytes_threshold(c$id, T);
print get_current_conn_bytes_threshold(c$id, F);
print get_current_conn_packets_threshold(c$id, T);
print get_current_conn_packets_threshold(c$id, F);
print fmt("Threshold set for %s", cat(c$id));
set_conn_bytes_threshold(c$id, 3000, T);
set_conn_bytes_threshold(c$id, 2000, F);
set_current_conn_bytes_threshold(c$id, 3000, T);
set_current_conn_bytes_threshold(c$id, 2000, F);
set_conn_packets_threshold(c$id, 50, F);
set_conn_packets_threshold(c$id, 63, T);
set_current_conn_packets_threshold(c$id, 50, F);
set_current_conn_packets_threshold(c$id, 63, T);
print get_conn_bytes_threshold(c$id, T);
print get_conn_bytes_threshold(c$id, F);
print get_conn_packets_threshold(c$id, T);
print get_conn_packets_threshold(c$id, F);
print get_current_conn_bytes_threshold(c$id, T);
print get_current_conn_bytes_threshold(c$id, F);
print get_current_conn_packets_threshold(c$id, T);
print get_current_conn_packets_threshold(c$id, F);
}
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)

30
testing/btest/scripts/base/protocols/conn/threshold.bro Normal file
View file

@ -0,0 +1,30 @@
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event connection_established(c: connection)
{
print fmt("Threshold set for %s", cat(c$id));
ConnThreshold::set_bytes_threshold(c, 1, T);
ConnThreshold::set_bytes_threshold(c, 2500, T);
ConnThreshold::set_bytes_threshold(c, 2700, T);
ConnThreshold::set_bytes_threshold(c, 3000, T);
ConnThreshold::delete_bytes_threshold(c, 3000, T);
ConnThreshold::set_bytes_threshold(c, 2000, F);
ConnThreshold::set_packets_threshold(c, 50, F);
ConnThreshold::set_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 52, F);
ConnThreshold::delete_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered bytes", c$id, threshold, is_orig;
}
event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered packets", c$id, threshold, is_orig;
}