6 commits

Author	SHA1	Message	Date
Tim Wojtulewicz	05574ecce1	Add VXLAN packet analyzer, disable old analyzer	2021-11-23 19:36:50 -07:00
Tim Wojtulewicz	f7e3556a67	Store a single map of Sessions instead of split maps of Connections. ... This commit also includes: - Storing the transport protocol in ConnID and ConnIDKey to allow tcp and udp connections from the same IP/Port combinations. This happens in the core.cisco-fabric-path test, for example. - Lots of test updates. The reasons for these are two fold. First, with the change to only store a single map means that TCP, UDP, and ICMP connections are now mixed. When Zeek drains the map at shutdown, it drains each of those protocols together instead of separately. The second is because of how Sessions are stored in the map. We're now storing them keyed by the hash of the key stored by the Session objects, which causes them to again be in the map in a different order.	2021-04-29 10:24:45 -07:00
Christian Kreibich	0b674eb851	Baseline refresh to reflect btest 0.64	2020-12-06 20:19:49 -08:00
Tim Wojtulewicz	01207c0720	Fix unit tests for new ordering from NetSessions::Drain	2019-08-21 09:24:02 -04:00
Jon Siwek	09ae539ea8	GH-250: Improve/cleanup VXLAN decapsulation support ... * Better parsing/error-checking of VXLAN and encapsulated packet headers * Add/implement the "vxlan_packet" event * Add "Tunnel::vxlan_ports" option to tune the set of VXLAN ports to analyze/decapsulate * Add "Tunnel::validate_vxlan_checksums" option to allow for tuning of how checksums associated with the outer UDP header of a possible VXLAN tunnel are handled Fixes GH-250	2019-03-12 18:15:34 -07:00
Henrik Lund Kramshoej	f4088be8a6	Initial VXLAN support, need -C flag to work when running bro	2019-03-11 14:15:39 -07:00