Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
zeek/scripts/base/protocols/sip
History
Jon Siwek 35827eeb31 Add rate-limiting sampling mechanism for weird events 
The generation of weird events, by default, are now rate-limited
according to these tunable options:

  - Weird::sampling_whitelist
  - Weird::sampling_threshold
  - Weird::sampling_rate
  - Weird::sampling_duration

The new get_reporter_stats() BIF also allows one to query the
total number of weirds generated (pre-sampling) which the new
policy/misc/weird-stats.bro script uses periodically to populate
a weird_stats.log.

There's also new reporter BIFs to allow generating weirds from the
script-layer such that they go through the same, internal
rate-limiting/sampling mechanisms:

  - Reporter::conn_weird
  - Reporter::flow_weird
  - Reporter::net_weird

Some of the code was adapted from previous work by Johanna Amann.
2018-07-26 19:57:36 -05:00
..
__load__.bro Merge remote-tracking branch 'origin/master' into topic/vladg/sip 2014-04-22 18:58:22 -04:00
dpd.sig Merge remote-tracking branch 'origin/topic/vladg/sip' 2015-04-21 15:30:25 -07:00
main.bro Add rate-limiting sampling mechanism for weird events 2018-07-26 19:57:36 -05:00
README Add missing documentation on the "Bro Package Index" page 2015-06-02 10:00:00 -05:00

README 

Support for Session Initiation Protocol (SIP) analysis.