Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add high level api for thresholding that holds lists of thresholds

Browse source 
and raises an event for each threshold exactly once.
This commit is contained in:
Johanna Amann 2015-04-16 15:36:48 -07:00
parent 9290718bd6
commit d876c044df
9 changed files with 381 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

30
testing/btest/scripts/base/protocols/conn/threshold.bro Normal file
View file

@ -0,0 +1,30 @@
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
event connection_established(c: connection)
{
print fmt("Threshold set for %s", cat(c$id));
ConnThreshold::set_bytes_threshold(c, 1, T);
ConnThreshold::set_bytes_threshold(c, 2500, T);
ConnThreshold::set_bytes_threshold(c, 2700, T);
ConnThreshold::set_bytes_threshold(c, 3000, T);
ConnThreshold::delete_bytes_threshold(c, 3000, T);
ConnThreshold::set_bytes_threshold(c, 2000, F);
ConnThreshold::set_packets_threshold(c, 50, F);
ConnThreshold::set_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 52, F);
ConnThreshold::delete_packets_threshold(c, 51, F);
ConnThreshold::set_packets_threshold(c, 63, T);
ConnThreshold::delete_packets_threshold(c, 63, T);
}
event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered bytes", c$id, threshold, is_orig;
}
event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
{
print "triggered packets", c$id, threshold, is_orig;
}