Commit graph

7 commits

Author SHA1 Message Date
Jon Siwek
2d7c926291 GH-545: add "addl" parameter to flow_weird and net_weird events 2019-08-20 22:45:22 -04:00
Jon Siwek
2fa74e4bcb Change default value of peer_description "zeek" 2019-06-06 19:49:30 -07:00
Jon Siwek
995368e68c Remove variable content from weird names
This changes many weird names to move non-static content from the
weird name into the "addl" field to help ensure the total number of
weird names is reasonably bounded.  Note the net_weird and flow_weird
events do not have an "addl" parameter, so information may no longer
be available in those cases -- to make it available again we'd need
to either (1) define new events that contain such a parameter, or
(2) change net_weird/flow_weird event signature (which is a breaking
change for user-code at the moment).

Also, the generic handling of binpac exceptions for analyzers which
to not otherwise catch and handle them has been changed from a Weird
to a ProtocolViolation.

Finally, a new "file_weird" event has been added for reporting
weirdness found during file analysis.
2019-04-01 18:30:11 -07:00
Robin Sommer
1fd0d7a607 Changing the start/end markers in logs to open/close now reflecting
wall clock.

Triggers lots of (simple) baseline updates.
2012-07-27 12:15:21 -07:00
Robin Sommer
5cfb8d65c3 Updating tests for the #start/#end change. 2012-07-19 22:28:55 -07:00
Daniel Thayer
508d39457a Update tests (use weird.log instead of stderr) 2012-05-11 17:09:01 -05:00
Jon Siwek
91330f1e1c Add support for mobile IPv6 Mobility Header (RFC 6275).
- Accessible at script-layer through 'mobile_ipv6_message' event.

- All Mobile IPv6 analysis now enabled through --enable-mobile-ipv6
  configure-time option, otherwise the mobility header, routing type 2,
  and Home Address Destination option are ignored.
2012-04-09 14:39:00 -05:00