From ff51068598cc3d4815c0139391afee3adc938c9f Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Sat, 22 Oct 2011 01:13:15 -0400 Subject: [PATCH] Fixing a bug with handling downgrade from weird conn to orig. --- scripts/base/frameworks/notice/weird.bro | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/base/frameworks/notice/weird.bro b/scripts/base/frameworks/notice/weird.bro index 38dea64b29..2303c97fbc 100644 --- a/scripts/base/frameworks/notice/weird.bro +++ b/scripts/base/frameworks/notice/weird.bro @@ -286,8 +286,8 @@ function report(t: time, name: string, identifier: string, have_conn: bool, addl if ( action in notice_actions ) { # Handle notices - if ( action == ACTION_NOTICE_PER_ORIG && have_conn ) - identifier = flow_id_string(current_conn$id$orig_h, current_conn$id$resp_h); + if ( have_conn && action == ACTION_NOTICE_PER_ORIG ) + identifier = fmt("%s", current_conn$id$orig_h); else if ( action == ACTION_NOTICE_ONCE ) identifier = ""; @@ -299,8 +299,8 @@ function report(t: time, name: string, identifier: string, have_conn: bool, addl else { # Handle logging. - if ( action == ACTION_LOG_PER_ORIG && have_conn ) - identifier = flow_id_string(current_conn$id$orig_h, current_conn$id$resp_h); + if ( have_conn && action == ACTION_LOG_PER_ORIG ) + identifier = fmt("%s", current_conn$id$orig_h); else if ( action == ACTION_LOG_ONCE ) identifier = "";