Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Removed some fields from http analysis that weren't commonly needed or were wrong.

Browse source
This commit is contained in:
Seth Hall 2011-10-25 09:32:31 -04:00
parent 320739e183
commit dcc8d8456a
1 changed files with 11 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/http/main.bro
View file

@ -33,17 +33,9 @@ export {
## The actual uncompressed content size of the data transferred from ## The actual uncompressed content size of the data transferred from
## the client. ## the client.
request_body_len: count &log &default=0; request_body_len: count &log &default=0;
## This indicates whether or not there was an interruption while the
## request body was being sent.
request_body_interrupted: bool &log &default=F;
## The actual uncompressed content size of the data transferred from ## The actual uncompressed content size of the data transferred from
## the server. ## the server.
response_body_len: count &log &default=0; response_body_len: count &log &default=0;
## This indicates whether or not there was an interruption while the
## request body was being sent. An interruption could cause hash
## calculation to fail and a number of other problems since the
## analyzer may not be able to get back on track with the connection.
response_body_interrupted: bool &log &default=F;
## The status code returned by the server. ## The status code returned by the server.
status_code: count &log &optional; status_code: count &log &optional;
## The status message returned by the server. ## The status message returned by the server.
@ -253,15 +245,9 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
set_state(c, F, is_orig); set_state(c, F, is_orig);
if ( is_orig ) if ( is_orig )
{
c$http$request_body_len = stat$body_length; c$http$request_body_len = stat$body_length;
c$http$request_body_interrupted = stat$interrupted;
}
else else
{
c$http$response_body_len = stat$body_length; c$http$response_body_len = stat$body_length;
c$http$response_body_interrupted = stat$interrupted;
}
} }
event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &priority = -5 event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &priority = -5