mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
af5a0215c0
This adds machinery to the packet_analysis manager for disabling and enabling packet analyzers and implements two low-level bifs to use it. Extend Analyzer::enable_analyzer() and Analyzer::disable_analyzer() to transparently work with packet analyzers, too. This also allows to add packet analyzers to Analyzer::disabled_analyzers.
21 lines
643 B
Text
21 lines
643 B
Text
# @TEST-DOC: Add a packet analyzer to Analyzer::disabled_analyzers and ensure it does not generate events (vxlan in this case).
|
|
# @TEST-EXEC: zeek -b -r $TRACES/tunnels/vxlan.pcap %INPUT > output
|
|
# @TEST-EXEC: btest-diff output
|
|
#
|
|
|
|
# Removing this line triggers vxlan events from all but the first two packets.
|
|
redef Analyzer::disabled_analyzers += { PacketAnalyzer::ANALYZER_VXLAN };
|
|
|
|
global all_packets = 0;
|
|
|
|
event raw_packet(hdr: raw_pkt_hdr)
|
|
{
|
|
++all_packets;
|
|
print "packet", all_packets;
|
|
}
|
|
|
|
# Should never run.
|
|
event vxlan_packet(outer: connection, inner: pkt_hdr, vni: count)
|
|
{
|
|
print "vxlan_packet", outer$uid, "inner", inner$ip;
|
|
}
|