Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add SkipAnalyzer.

Browse source 
This is WIP: The test case would require a new pcap or the possibility
to overwrite analyzer mappings. The CustomEncapsulationSkip method and
the corresponding options need to be removed.
This commit is contained in:
Jan Grashoefer 2020-08-25 17:03:20 +02:00 • committed by Tim Wojtulewicz
parent 6f6e5b4df0
commit fc814bd7e2
11 changed files with 113 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/packet-protocols/__load__.zeek
View file

@ -1,4 +1,5 @@
@load base/packet-protocols/default
@load base/packet-protocols/skip
@load base/packet-protocols/ethernet
@load base/packet-protocols/fddi
@load base/packet-protocols/ieee802_11

2
scripts/base/packet-protocols/default/main.zeek
View file

@ -1,4 +1,4 @@
module PacketAnalyzer::DEFAULT;
module PacketAnalyzer::Default;
redef PacketAnalyzer::config_map += {
PacketAnalyzer::ConfigEntry($analyzer=PacketAnalyzer::ANALYZER_DEFAULTANALYZER),

1
scripts/base/packet-protocols/skip/__load__.zeek Normal file
View file

@ -0,0 +1 @@
@load ./main

10
scripts/base/packet-protocols/skip/main.zeek Normal file
View file

@ -0,0 +1,10 @@
module PacketAnalyzer::SkipAnalyzer;
export {
## Bytes to skip.
const skip_bytes: count = 0 &redef;
}
redef PacketAnalyzer::config_map += {
PacketAnalyzer::ConfigEntry($parent=PacketAnalyzer::ANALYZER_SKIP, $analyzer=PacketAnalyzer::ANALYZER_DEFAULTANALYZER)
};