Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'master' of https://github.com/aaronmbr/bro

Browse source 
* 'master' of https://github.com/aaronmbr/bro:
  Copy-paste issue
  Allow for logging of the VLAN data about a connection in conn.log
  Save the inner vlan in the Packet object for Q-in-Q setups
This commit is contained in:
Robin Sommer 2015-07-23 13:01:35 -07:00
commit fb848f795d
21 changed files with 338 additions and 233 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/policy/protocols/conn/vlan-logging.bro Normal file
View file

@ -0,0 +1,26 @@
##! This script add VLAN information to the connection logs
@load base/protocols/conn
module Conn;
redef record Info += {
## The outer VLAN for this connection, if applicable.
vlan: int &log &optional;
## The inner VLAN for this connection, if applicable.
inner_vlan: int &log &optional;
};
# Add the VLAN information to the Conn::Info structure after the connection
# has been removed. This ensures it's only done once, and is done before the
# connection information is written to the log.
event connection_state_remove(c: connection) &priority=5
{
if ( c?$vlan )
c$conn$vlan = c$vlan;
if ( c?$inner_vlan )
c$conn$inner_vlan = c$inner_vlan;
}