mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 22:18:20 +00:00
e5a434c392
This adds a new PacketAnalyzer::PPPoE::session_id bif, which extracts the PPPoE session ID from the current packet. Furthermore, a new policy script is added which adds the pppoe session id to the connection log. Related to GH-4602
27 lines
636 B
Text
27 lines
636 B
Text
##! This script adds PPPoE session ID information to the connection log.
|
|
|
|
@load base/protocols/conn
|
|
|
|
module Conn;
|
|
|
|
redef record Info += {
|
|
## The PPPoE session id, if applicable for this connection.
|
|
pppoe_session_id: count &log &optional;
|
|
};
|
|
|
|
# Add the PPPoE session ID to the Conn::Info structure. We have to do this right
|
|
# at the beginning, while we are handling a packet.
|
|
event new_connection(c: connection)
|
|
{
|
|
local session_id = PacketAnalyzer::PPPoE::session_id();
|
|
|
|
# no session ID
|
|
if ( session_id == 0xFFFFFFFF )
|
|
return;
|
|
|
|
# FIXME: remove when GH-4688 is merged
|
|
set_conn(c, F);
|
|
|
|
c$conn$pppoe_session_id = session_id;
|
|
}
|
|
|