Commit graph

12 commits

Author SHA1 Message Date
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Seth Hall
de7396e4a9 Add a round trip time (rtt) field to dns.log.
Updated tests as well.
2016-06-15 00:17:23 -04:00
Jon Siwek
de0ce6deed BIT-1156: Fix parsing of DNS TXT RRs w/ multiple character-strings.
The "dns_TXT_reply" event now uses a "vector of strings" as the final
parameter instead of just a "string" in order to support DNS TXT
resource records that contain multiple character-strings.

The format in which the TXT answers are logged by default is now changed
to be a list of strings of the form `fmt("TXT %d %s", |str|, str)`, one
for each character-string in the RR and delimited by a space (' ')
character.
2014-04-24 16:20:01 -05:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
2013-08-26 15:36:31 -05:00
Seth Hall
ae9a02140e Fix the issue with transaction ID reuse in a single DNS connection.
- Each transaction ID within a connection is now maintained as
   a queue of DNS::Info logging records.

 - New function added to the queue.bro script to support
   peeking at the new gettable item in the queue without removing it.
2013-05-17 10:35:08 -04:00
Seth Hall
db62369508 Fix for DNS log problem when a DNS response is seen with 0 RRs. 2012-10-05 13:48:49 -04:00
Robin Sommer
1fd0d7a607 Changing the start/end markers in logs to open/close now reflecting
wall clock.

Triggers lots of (simple) baseline updates.
2012-07-27 12:15:21 -07:00
Robin Sommer
5cfb8d65c3 Updating tests for the #start/#end change. 2012-07-19 22:28:55 -07:00
Robin Sommer
fe2535b08d Updating baselines for DNS change. 2012-04-16 18:08:16 -07:00
Jon Siwek
c765f43fe3 Refactor script-layer IPv6 ext. header chain (addresses #795)
This replaces the "ip6_hdr_chain" in the "ip6_hdr" record with a vector of
"ip6_ext_hdr" to make it easier to traverse the chain.
2012-03-21 10:34:38 -05:00
Jon Siwek
1c1d657039 Changes to IPv6 ext. header parsing (addresses #795).
In response to feedback from Robin:

  - rename "ip_hdr" to "ip4_hdr"

  - pkt_hdr$ip6 is now of type "ip6_hdr" instead of "ip6_hdr_chain"

  - "ip6_hdr_chain" no longer contains an "ip6_hdr" field, instead
    it's the other way around, "ip6_hdr" contains an "ip6_hdr_chain"

  - other internal refactoring
2012-03-20 15:50:17 -05:00
Jon Siwek
e74cbbf774 Add unit test for IPv6 fragment reassembly. 2012-03-12 15:26:51 -05:00