mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 00:58:19 +00:00
38dbba7622
- The reassembly behavior can be modified per-file by enabling or disabling the reassembler and/or modifying the size of the reassembly buffer. - Changed the file extraction analyzer to use the stream to avoid issues with the chunk based approach not immediately triggering the file_new event due to mime-type detection delay. Early chunks frequently ended up lost before. - Generally things are working now and I'd consider this in testing. |
||
|---|---|---|
| .. | ||
| a.out | ||
| a.size | ||
| b.out | ||
| b.size | ||
| c.out | ||
| c.size | ||