Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new

Browse source
This commit is contained in:
Seth Hall 2011-05-26 00:28:37 -04:00
commit e07189e129
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
doc/scripts/CMakeLists.txt
View file

@ -132,6 +132,8 @@ endmacro(REST_TARGET)
rest_target(${CMAKE_CURRENT_SOURCE_DIR} example.bro internal) rest_target(${CMAKE_CURRENT_SOURCE_DIR} example.bro internal)
rest_target(${POLICY_SRC_DIR} conn.bro user) rest_target(${POLICY_SRC_DIR} conn.bro user)
rest_target(${POLICY_SRC_DIR} conn/base.bro user)
rest_target(${POLICY_SRC_DIR} conn/contents.bro user)
rest_target(${POLICY_SRC_DIR} dns.bro policy/dns-index) rest_target(${POLICY_SRC_DIR} dns.bro policy/dns-index)
rest_target(${POLICY_SRC_DIR} dns/auth-addl.bro policy/dns-index) rest_target(${POLICY_SRC_DIR} dns/auth-addl.bro policy/dns-index)

12
policy/conn/contents.bro
View file

@ -1,15 +1,15 @@
##! This script can be used to extract either the originator's data or the ##! This script can be used to extract either the originator's data or the
##! responders data or both. By default nothing is extracted, and in order ##! responders data or both. By default nothing is extracted, and in order
##! to actually extract data the :bro:id:`c$extract_orig` and/or the ##! to actually extract data the ``c$extract_orig`` and/or the
##! :bro:id:`c$extract_resp` variable must be set to T. One way to achieve ##! ``c$extract_resp`` variable must be set to T. One way to achieve
##! would be to handle the connection_established event elsewhere and set the ##! would be to handle the connection_established event elsewhere and set the
##! extract_orig and extract_resp options there. ##! extract_orig and extract_resp options there.
##! This script does not work well in a cluster context unless it has a remotely ##! This script does not work well in a cluster context unless it has a remotely
##! mounted disk to write the content files to. ##! mounted disk to write the content files to.
##!
##! Note: This script has a problem is another connection happens using the ##! .. note:: This script has a problem if another connection happens using the
##! same IP addresses and ports. There is nothing in place to test for ##! same IP addresses and ports. There is nothing in place to test for
##! the existence of a file. ##! the existence of a file.
module Conn; module Conn;