Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Move spicy/misc scripts to policy and clarify purpose.

Browse source
This commit is contained in:
Robin Sommer 2023-05-15 17:20:01 +02:00
parent a62e153dd3
commit ecf00295c2
No known key found for this signature in database
GPG key ID: D8187293B3FFE5D0
6 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/frameworks/spicy/init-bare.zeek
View file

@ -23,7 +23,8 @@ export {
# doc-options-end
# doc-types-start
## Result type for `Spicy::resource_usage()`.
## Result type for `Spicy::resource_usage()`. The values reflect resource
## usage as reported by the Spicy runtime system.
type ResourceUsage: record {
user_time : interval; ##< user CPU time of the Zeek process
system_time :interval; ##< system CPU time of the Zeek process

90
scripts/base/frameworks/spicy/misc/record-spicy-batch.zeek
View file

@ -1,90 +0,0 @@
# Saves all input traffic in Spicy's batch format.
module SpicyBatch;
export {
const filename = "batch.dat" &redef;
}
redef tcp_content_deliver_all_orig=T;
redef tcp_content_deliver_all_resp=T;
redef udp_content_deliver_all_orig=T;
redef udp_content_deliver_all_resp=T;
global output: file;
global conns: set[conn_id];
global num_conns = 0;
function id(c: connection) : string
{
local cid = c$id;
local proto = "???";
if ( is_tcp_port(cid$orig_p) )
proto = "tcp";
else if ( is_udp_port(cid$orig_p) )
proto = "udp";
else if ( is_icmp_port(cid$orig_p) )
proto = "icmp";
return fmt("%s-%d-%s-%d-%s", cid$orig_h, cid$orig_p, cid$resp_h, cid$resp_p, proto);
}
function begin(c: connection, type_: string)
{
add conns[c$id];
++num_conns;
print fmt("tracking %s", c$id);
local id_ = id(c);
print output, fmt("@begin-conn %s %s %s-orig %s%%orig %s-resp %s%%resp\n", id_, type_, id_, c$id$resp_p, id_, c$id$resp_p);
}
event zeek_init()
{
output = open(filename);
enable_raw_output(output);
print output, "!spicy-batch v2\n";
}
event new_connection_contents(c: connection)
{
begin(c, "stream");
}
event tcp_contents(c: connection, is_orig: bool, seq: count, contents: string)
{
print output, fmt("@data %s-%s %d\n", id(c), (is_orig ? "orig" : "resp"), |contents|);
print output, contents;
print output, "\n";
}
event content_gap(c: connection, is_orig: bool, seq: count, length: count)
{
print output, fmt("@gap %s-%s %d\n", id(c), (is_orig ? "orig" : "resp"), length);
}
event udp_contents(c: connection, is_orig: bool, contents: string)
{
if ( c$id !in conns )
begin(c, "block");
print output, fmt("@data %s-%s %d\n", id(c), (is_orig ? "orig" : "resp"), |contents|);
print output, contents;
print output, "\n";
}
event connection_state_remove(c: connection)
{
if ( c$id !in conns )
return;
print output, fmt("@end-conn %s\n", id(c));
}
event zeek_done()
{
close(output);
print fmt("recorded %d session%s total", num_conns, (num_conns > 1 ? "s" : ""));
print fmt("output in %s", filename);
}

18
scripts/base/frameworks/spicy/misc/resource-usage.zeek
View file

@ -1,18 +0,0 @@
module Spicy;
event print_usage()
{
local r = Spicy::resource_usage();
print fmt("%.6f Spicy user=%f sys=%f heap=%d current_fibers=%d cached_fibers=%d max_fibers=%d max_stack=%d",
network_time(), r$user_time, r$system_time, r$memory_heap,
r$num_fibers, r$cached_fibers, r$max_fibers,
r$max_fiber_stack_size);
schedule 1 min { print_usage() };
}
event zeek_init()
{
schedule 1 min { print_usage() };
}