Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Minor review nits

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-11-12 21:22:52 -07:00
parent 43e77a3338
commit fd67206865
7 changed files with 18 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/policy/protocols/conn/disable-unknown-ip-proto-support.zeek
View file

@ -8,4 +8,4 @@ redef record Conn::Info$ip_proto -= { &log };
event zeek_init() {
Analyzer::disable_analyzer(PacketAnalyzer::ANALYZER_UNKNOWN_IP_TRANSPORT);
}
}

8
scripts/policy/protocols/conn/ip-proto-name-logging.zeek
View file

@ -157,15 +157,13 @@ global protocol_names: table[count] of string = {
[142] = "rohc",
[143] = "ethernet",
[144] = "aggfrag",
[145] = "nsh"
[145] = "nsh",
[146] = "homa"
};
event new_connection(c: connection) &priority=5 {
# In case we're the first access
Conn::set_conn(c, F);
if ( c$conn?$ip_proto && c$conn$ip_proto in protocol_names ) {
if ( c$conn?$ip_proto && c$conn$ip_proto in protocol_names )
c$conn$ip_proto_name = protocol_names[c$conn$ip_proto];
} else {
c$conn$ip_proto_name = "unknown";
}
}