Commit graph

13 commits

Author SHA1 Message Date
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Jan Grashoefer
50cf694aae Moved link-layer addresses into endpoints.
The link-layer addresses are now part of the connection endpoints
following the originator-responder-pattern. The addresses are printed
with leading zeros. Additionally link-layer addresses are also extracted
for 802.11 plus RadioTap.
2016-06-02 01:46:26 +02:00
Robin Sommer
57aef6d49f Add MAC addresses to connection record.
c$eth_src and c$eth_dst now contain the Ethernet address if available.
A new script protocols/conn/mac-logging.bro adds these to conn.log
when loaded.
2016-05-29 17:18:47 -07:00
Robin Sommer
30bb17ea8d Baseline update. 2015-07-24 15:07:03 -07:00
Robin Sommer
fb848f795d Merge branch 'master' of https://github.com/aaronmbr/bro
* 'master' of https://github.com/aaronmbr/bro:
  Copy-paste issue
  Allow for logging of the VLAN data about a connection in conn.log
  Save the inner vlan in the Packet object for Q-in-Q setups
2015-07-23 13:05:28 -07:00
Aaron Brown
f29dbb90a5 Allow for logging of the VLAN data about a connection in conn.log 2015-07-22 14:13:17 -04:00
Robin Sommer
770f833ea2 Removing deprecated fields from the connection record.
Removing "hot" and "addl", which haven't been used anymore for a long
time. Also removing the functions append_addl() and append_addl_marker().
2015-04-20 20:07:24 -07:00
Johanna Amann
b44b725d59 Wrap threshold stuff up - fix two small bugs and update baselines. 2015-04-17 09:59:34 -07:00
Robin Sommer
5dea09b7c1 Baseline updates for the addition of local_resp.
That patch is a strong contender for the smallest ever ratio of
lines-of-code-changed to lines-of-baselines-updated. :-)
2015-02-23 16:25:11 -08:00
Jon Siwek
31866f8f59 Change dns.log to include only standard DNS queries.
The scope of dns.log is now only standard queries (OPCODE == 0).  Other
kinds of queries (e.g. inverse query) were not handled correctly and
could interfere with the state tracking of the default DNS scripts.
2014-01-28 13:56:22 -06:00
Robin Sommer
364cdb8604 Updating Sphinx tests for manual. 2013-10-07 16:48:38 -07:00
Robin Sommer
ac66db286a Merge remote-tracking branch 'origin/topic/documentation'
I'm merging in the documentation branch to avoid that it keeps getting
out of sync. We still need to work on this a bit more, I'll summarize
in a mail.

* origin/topic/documentation: (68 commits)
  Going over initial parts of the scripting overview.
  Adding lines in scripting/index.txt. No other change.
  Updating submodule.
  Pass over the Using Bro section.
  Applying doc updates from BIT-1063. (Anthony Verez)
  Breaking lines in using/*.
  More doc reorg, and a light pass over the first 3 sections.
  Starting to put a new structure in place.
  Updating submodule(s).
  Updating submodule(s).
  Adding some temporary testing/demonstration to front page.
  Switching btest to topic/robin/parts branch.
  Basic cross-referencing UIDs between files, btests, and baselines.
  A truly embarassing number of spelling corrections.
  Using redirection with bro-cut.  Include initial btests for this document.
  Corrected a mis-typed RST include.
  Initial start for "Using Bro".
  Spelling corrections.
  Include Notice Policy shortcuts in the Scripting User Manual.
  Notice::policy hooks and tests.
  ...

Conflicts:
	src/3rdparty
2013-08-31 16:07:44 -07:00
Robin Sommer
b74bf10565 Going over initial parts of the scripting overview.
I made a light pass over the text. Switched the includes over to the
new btest-include and adapted the other TEXT-EXECs a bit.

Also includes more tweaking all over the Sphinx setup.
2013-08-30 16:23:17 -07:00