mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
51836d08ae
This analyzer can be used to transport raw stream data for a given connection to the script layer. For example, adding this analyzer into the HTTP::upgrade_analyzer or using it to configure a child WebSocket analyzer allows to get access to the raw stream data in script land when no more appropriate protocol analyzer is available.
30 lines
676 B
Text
30 lines
676 B
Text
# @TEST-DOC: Show-case disable_analyzer() for ANALYZER_STREAM_EVENT after receiving a few events.
|
|
# @TEST-EXEC: zeek -b -r $TRACES/http/get.trace %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
event zeek_init()
|
|
{
|
|
Analyzer::register_for_port(Analyzer::ANALYZER_STREAM_EVENT, 80/tcp);
|
|
}
|
|
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
print c$uid, "new_connection";
|
|
}
|
|
|
|
global deliveries = 0;
|
|
|
|
event stream_deliver(c: connection, is_orig: bool, data: string)
|
|
{
|
|
++deliveries;
|
|
print c$uid, is_orig, |data|, data[:32];
|
|
|
|
if ( deliveries == 2 )
|
|
disable_analyzer(c$id, current_analyzer());
|
|
}
|
|
|
|
event connection_state_remove(c: connection)
|
|
{
|
|
print c$uid, "connection_state_remove";
|
|
}
|