7 commits

Author	SHA1	Message	Date
Tim Wojtulewicz	5e5aceb6f7	Rename protocol_id field to ip_proto and similar renaming for name field	2024-11-13 12:02:00 -07:00
Tim Wojtulewicz	35ec9733c0	Add conn.log entries for connections with unhandled IP protocols	2024-11-13 11:25:40 -07:00
Christian Kreibich	1843e2daae	Update btest baselines to reflect the use of local address ranges.	2023-03-15 17:11:04 -07:00
Christian Kreibich	0b674eb851	Baseline refresh to reflect btest 0.64	2020-12-06 20:19:49 -08:00
Johanna Amann	6f9524e082	Make tunnel_parents in conn.log optional. ... This makes conn.logs a bit prettier (and smaller) because all lines that do not use a tunnel will now have a "-" instead of the "(empty)" for tunnel_parents.	2018-01-12 13:46:00 -08:00
Johanna Amann	313647ce0e	Merge remote-tracking branch 'origin/master' into topic/johanna/bit-1612	2016-07-13 10:58:56 -07:00
Robin Sommer	39734255be	Change TCP analysis to process connections without the initial SYN as ... non-partial connections. Before, if we saw a responder-side SYN/ACK, but had not seen the initial orginator-side SYN, Bro would treat the connection as partial, meaning that most application-layer analyzers would refuse to inspect the payload. That was unfortunate because all payload data was actually there (and even passed to the analyzers). This change make Bro consider these connections as complete, so that analyzers will just normally process them. The leads to couple more connections in the test-suite to now being analyzed. Addresses #1492. (I used an HTTP trace for debugging instead of the HTTPS trace from the ticket, as the clear-text makes it easier to track the data flow).	2016-07-11 17:18:32 -07:00