Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Allow setting packet and byte thresholds for connections.

Browse source 
This extends the ConnSize analyzer to be able to raise events when each
direction of a connection crosses a certain amount of bytes or packets.

Thresholds are set using
set_conn_bytes_threshold(c$id, [num-bytes], [direction]);
and
set_conn_packets_threshold(c$id, [num-packets], [direction]);
respectively.

They raise the event
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
and
event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
respectively.

Current thresholds can be examined using
get_conn_bytes_threshold and get_conn_packets_threshold

Currently only one threshold can be set per connection.

This also fixes a bug where child packet analyzers of the TCP analyzer
where not found using FindChild.
This commit is contained in:
Johanna Amann 2015-04-16 12:44:45 -07:00
parent a129911272
commit f7edf70882
10 changed files with 321 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/analyzer/protocol/tcp/TCP.h
View file

@ -47,8 +47,10 @@ public:
// Add a child analyzer that will always get the packets,
// independently of whether we do any reassembly.
void AddChildPacketAnalyzer(analyzer::Analyzer* a)
{ packet_children.push_back(a); a->SetParent(this); }
void AddChildPacketAnalyzer(analyzer::Analyzer* a);
virtual Analyzer* FindChild(ID id);
virtual Analyzer* FindChild(Tag tag);
// True if the connection has closed in some sense, false otherwise.
int IsClosed() const { return orig->did_close || resp->did_close; }