Commit graph

8 commits

Author SHA1 Message Date
Tim Wojtulewicz
a33f100880 Add support for ircv3 tags
This also replaces the irc-dcc-send.trace file in our pcap library with
a cleaner one that includes ircv3 tags.
2025-07-28 14:06:33 -07:00
Arne Welzel
112e3c1c03 btest: Update tests and baselines after adding ctx to conn_id 2025-07-03 18:19:46 +02:00
Tim Wojtulewicz
35ec9733c0 Add conn.log entries for connections with unhandled IP protocols 2024-11-13 11:25:40 -07:00
Christian Kreibich
0b674eb851 Baseline refresh to reflect btest 0.64 2020-12-06 20:19:49 -08:00
Jon Siwek
5b4313b593 Deprecate Val(double, TypeTag) ctor, add TimeVal/DoubleVal subclasses
This also updates all usages of the deprecated Val ctor to use
either IntervalVal, TimeVal, or DoubleVal ctors.  The reason for
doing away with the old constructor is that using it with TYPE_INTERVAL
isn't strictly correct since there exists a more specific subclass,
IntervalVal, with overriden ValDescribe() method that ought to be used
to print such values in a more descriptive way.
2020-06-02 23:33:40 -07:00
Jon Siwek
bc5844b24c Fix connection duration thresholding
Connection durations were being compared "less than" instead of "greater
than" the desired duration threshold as provided to
set_current_conn_bytes_threshold() or
ConnThreshold::set_duration_threshold()
2020-04-06 13:32:32 -07:00
Johanna Amann
9d489cde20 Add duration thresholding to the conn-size analyzer.
Now, in addition to setting thresholds for bytes and packet, one can set
a threshold for connection duration. Note that the threshold event is
only raised once the next packet in the connection is seen.

This also fixes a small pre-existing bug, in which a bunch of warnings
were raised if someone just used the lower-level functions without going
through the higher-level scripting API.
2019-08-01 11:57:40 -07:00
Johanna Amann
86c54c3dbd Add high level api for thresholding that holds lists of thresholds
and raises an event for each threshold exactly once.
2015-04-17 06:57:58 -07:00