Commit graph

7 commits

Author SHA1 Message Date
Robin Sommer
789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00
Jon Siwek
1e57e3f026 Use .zeek file suffix in unit tests 2019-04-16 16:08:57 -07:00
Johanna Amann
d091e9ca89 Fix duplication of new_connection_contents event
Addresses BIT-1602
2016-05-17 10:32:13 -07:00
Johanna Amann
86c54c3dbd Add high level api for thresholding that holds lists of thresholds
and raises an event for each threshold exactly once.
2015-04-17 06:57:58 -07:00
Jon Siwek
59ed5c75f1 FileAnalysis: add unit tests covering current protocol integration.
And had to make various fixes/refinements after scrutinizing results.
2013-03-19 15:50:05 -05:00
Jon Siwek
68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
Jon Siwek
5984564946 Change IPv6 address/prefix output format to be bracketed.
Also add a test case for content extraction.
2012-05-04 11:21:18 -05:00