Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Tunnel documentation tweaks.

Browse source 
Checkpoint. Need to check cross-references once "make doc" works again.
This commit is contained in:
Gregor Maier 2011-08-07 15:33:50 -07:00
parent cd592203a0
commit fe6a05e2ad
1 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/policy/frameworks/tunnel.bro
View file

@ -2,7 +2,21 @@
##!
##! Bro can decapsulate IPinIP and IPinUDP tunnels, were "IP" can be either
##! IPv4 or IPv6. The most common case will be decapsulating Teredo, 6to4,
##! 6in4, and AYIAY.
##! 6in4, and AYIAY. When this script is loaded, decapsulation will be
##! enabled. "tunnel.log" will log the "parent" for each tunneled
##! connection. The identity (and existence) of the tunnel connection
##! is otherwise lost.
##!
##! Currently handles:
##!
##! * IP6 in IP{4,6}. (IP4 in IP is easy to add, but omitted due to lack
##! of test cases.
##! * IP{4,6} in UDP. This decapsulates e.g., standard *Teredo* packets
##! (without authentication or origin indicator)
##! * IP{4,6} in AYIAY
##! * Only checks for UDP tunnels on Teredo's and AYIAY's default
##! ports. See :bro:id:`udp_tunnel_ports` and
##! :bro:id:`udp_tunnel_allports`
##!
##! Decapsulation happens early in a packets processing, right after IP
##! defragmentation but before there is a connection context. The tunnel
@ -11,13 +25,14 @@
##! which is of type :bro:type:`parent_t`.
##!
##! *Limitation:* The decapsulated packets are not fed through the
##! defragmenter again.
##! defragmenter again and decapsulation happens only on the primary
##! path, i.e., it's not available for the secondary path.
##!
##!
module Tunnel;
redef use_connection_compressor = F;
#redef use_connection_compressor = F;
redef Tunnel::decapsulate_ip = T;
redef Tunnel::decapsulate_udp = T;
redef Tunnel::udp_tunnel_allports = T;