mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
38dbba7622
- The reassembly behavior can be modified per-file by enabling or disabling the reassembler and/or modifying the size of the reassembly buffer. - Changed the file extraction analyzer to use the stream to avoid issues with the chunk based approach not immediately triggering the file_new event due to mime-type detection delay. Early chunks frequently ended up lost before. - Generally things are working now and I'd consider this in testing.
22 lines
592 B
Text
22 lines
592 B
Text
FILE_NEW
|
|
file #0, 0, 0
|
|
FILE_BOF_BUFFER
|
|
MZ\x90\0^C\0\0\0^D\0\0
|
|
MIME_TYPE
|
|
application/x-dosexec
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_STATE_REMOVE
|
|
file #0, 1022920, 0
|
|
[orig_h=192.168.72.14, orig_p=3254/tcp, resp_h=65.54.95.206, resp_p=80/tcp]
|
|
total bytes: 1022920
|
|
source: HTTP
|
|
MD5: fc13fee1d44ef737a3133f1298b21d28
|
|
SHA1: 7d99803eaf3b6e8dfa3581348bc694089579d25a
|
|
SHA256: dcb87a62a2b5d449abc138776000fd1b14edc690e9da6ea325b8f352ab033202
|
|
FILE_TIMEOUT
|
|
FILE_TIMEOUT
|
|
FILE_STATE_REMOVE
|
|
file #0, 0, 0
|
|
[orig_h=192.168.72.14, orig_p=3257/tcp, resp_h=65.54.95.14, resp_p=80/tcp]
|
|
total bytes: 1022920
|
|
source: HTTP
|