3 commits

Author	SHA1	Message	Date
Jon Siwek	31f60853c9	GH-646: add new "successful_connection_remove" event ... And switch Zeek's base scripts over to using it in place of "connection_state_remove". The difference between the two is that "connection_state_remove" is raised for all events while "successful_connection_remove" excludes TCP connections that were never established (just SYN packets). There can be performance benefits to this change for some use-cases. There's also a new event called ``connection_successful`` and a new ``connection`` record field named "successful" to help indicate this new property of connections.	2019-11-11 19:52:59 -08:00
Jan Grashoefer	81b2b21211	Improve logging of speculative service.	2019-08-30 15:16:37 +02:00
Jan Grashoefer	788b56a652	Add speculative service script. ... The speculative service script handles dpd_late_match events to extend conn.log with infos about potential protocol identifications.	2019-08-29 11:47:04 +02:00