zeek/doc/devel/spicy/examples/tftp-schedule-analyzer.zeek

function schedule_tftp_analyzer(id: conn_id)
    {
    # Schedule the TFTP analyzer for the expected next packet coming in on different
    # ports. We know that it will be exchanged between same IPs and reuse the
    # originator's port. "Spicy_TFTP" is the Zeek-side name of the TFTP analyzer
    # (generated from "Spicy::TFTP" in tftp.evt).
    Analyzer::schedule_analyzer(id$resp_h, id$orig_h, id$orig_p, Analyzer::ANALYZER_SPICY_TFTP, 1min);
    }

event tftp::read_request(c: connection, is_orig: bool, filename: string, mode: string)
    {
    print "TFTP read request", c$id, filename, mode;
    schedule_tftp_analyzer(c$id);
    }

event tftp::write_request(c: connection, is_orig: bool, filename: string, mode: string)
    {
    print "TFTP write request", c$id, filename, mode;
    schedule_tftp_analyzer(c$id);
    }

# Add handlers for other packet types so that we see their events being generated.
event tftp::data(c: connection, is_orig: bool, block_num: count, data: string)
    {
    print "TFTP data", block_num, data;
    }

event tftp::ack(c: connection, is_orig: bool, block_num: count)
    {
    print "TFTP ack", block_num;
    }

event tftp::error(c: connection, is_orig: bool, code: count, msg: string)
    {
    print "TFTP error", code, msg;
    }