mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
2f918ed9b2
- Updated the logic significantly: still filters out ICMP from being considered an active service (like before) and adds a new "Known::service_udp_requires_response" option (defaults to true) for whether to require UDP server response before being considered an active service. * 'topic/dopheide/known-services' of https://github.com/dopheide-esnet/zeek: Log services with unknown protocols
16 lines
532 B
Text
16 lines
532 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path known_services
|
|
#open 2020-05-29-22-23-37
|
|
#fields ts host port_num port_proto service
|
|
#types time addr port enum set[string]
|
|
1308930691.089263 172.16.238.131 22 tcp SSH
|
|
1308930694.550308 172.16.238.131 80 tcp HTTP
|
|
1308930703.068148 172.16.238.2 53 udp DNS
|
|
1308930716.462556 74.125.225.81 80 tcp HTTP
|
|
1308930718.361665 172.16.238.131 21 tcp FTP
|
|
1308930726.889624 141.142.192.39 22 tcp SSH
|
|
1308930728.226254 69.50.219.51 123 udp NTP
|
|
#close 2020-05-29-22-23-37
|