zeek/scripts/policy
Jon Siwek 68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
..
frameworks Enable Bro to communicate with peers over non-global IPv6 addresses. 2012-05-17 12:59:20 -05:00
integration/barnyard2 Fix some malformed Broxygen xref roles. 2011-12-16 14:30:36 -06:00
misc Fixing typos 2012-01-10 19:09:30 -08:00
protocols Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
tuning Fix some problems in logs-to-elasticsearch.bro 2012-08-14 15:09:38 -04:00