Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Allow for logging of the VLAN data about a connection in conn.log

Browse source
This commit is contained in:
Aaron Brown 2015-07-22 14:13:17 -04:00
parent d76c7a2657
commit f29dbb90a5
17 changed files with 298 additions and 217 deletions
Download patch file Download diff file Expand all files Collapse all files

30
scripts/policy/protocols/conn/vlan-logging.bro Normal file
View file

@ -0,0 +1,30 @@
##! This script add VLAN information to the connection logs
@load base/protocols/conn
module Conn;
redef record Info += {
## The Outer VLAN for this connection, if applicable
vlan: int &log &optional;
## The Inner VLAN for this connection, if applicable
inner_vlan: int &log &optional;
};
# Add the VLAN information to the Conn::Info structure after the connection has
# been removed. This ensures it's only done once, and is done before
# the connection information is written to the log.
event connection_state_remove(c: connection) &priority=5
{
if (c?$vlan)
{
c$conn$vlan = c$vlan;
}
if (c?$inner_vlan)
{
c$conn$inner_vlan = c$inner_vlan;
}
}