zeek/scripts/policy/protocols
Jon Siwek 68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
..
conn Add Conn and DNS protocol script documentation. (fixes #731) 2012-01-09 14:23:24 -06:00
dns Small script refinements and documentation updates. 2011-10-21 13:58:58 -04:00
ftp Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
http Add @load-sigs directive for loading signature files (addresses #551). 2012-06-01 14:10:23 -05:00
smtp Adding an identifier to the SMTP blocklist notices for duplicate suppression. 2012-08-23 13:55:04 -04:00
ssh Merge remote-tracking branch 'origin/master' into topic/bernhard/software 2012-01-20 12:51:58 -08:00
ssl Finished SSL & syslog autodocs. 2012-01-10 00:56:12 -05:00