zeek/scripts/base
Jon Siwek 3642ecc73e FileAnalysis: misc. tweaks/fixes.
- Add a timeout flag to file_analysis.log so it's easy to tell what
  has had at least one timeout trigger happen.

- Fix ftp-data service tag not being set for reused connections.

- Fix HTTP::Incorrect_File_Type because mime types returned by FAF have
  the charset still in them, but the HTTP::mime_types_extensions table
  does not and it requires an exact string match. (still ugly)

- Add TRIGGER_NEW_CONN to track files going over multiple connections.

- Add an initial file/mime type guess for non-linear file transfers.

- Fix a case where file/mime type detection would never be attempted
  if the start of the file was a content gap.

- Improve mime type tracking of HTTP byte-range/partial-content,
  even if the requests are pipelined or over multiple connections.

- I changed the modbus.events test because having the baseline output
  be 80+ MB is nuts and it was sensitive to connection record redefs.
2013-03-28 16:59:29 -05:00
..
frameworks FileAnalysis: misc. tweaks/fixes. 2013-03-28 16:59:29 -05:00
misc Merge remote-tracking branch 'origin/fastpath' 2012-12-14 14:34:51 -08:00
protocols FileAnalysis: misc. tweaks/fixes. 2013-03-28 16:59:29 -05:00
utils remove the byte_len and length bifs 2013-03-06 13:45:42 -08:00
init-bare.bro FileAnalysis: file handles now set from events. 2013-03-25 15:37:58 -05:00
init-default.bro Merge branch 'topic/robin/intel-framework-merge' 2012-11-05 16:00:38 -08:00