zeek/testing/btest/scripts/policy/protocols
Jon Siwek 68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
..
conn Logging framework update and mass Log::ID renaming. 2011-09-03 01:10:17 -04:00
dns Reorganizing btest/policy directory to match new scripts/ organization 2011-08-11 10:43:11 -05:00
ftp Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
http A few updates for SQL injection detection. 2011-12-12 14:26:54 -05:00