mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 04:58:21 +00:00
38dbba7622
- The reassembly behavior can be modified per-file by enabling or disabling the reassembler and/or modifying the size of the reassembly buffer. - Changed the file extraction analyzer to use the stream to avoid issues with the chunk based approach not immediately triggering the file_new event due to mime-type detection delay. Early chunks frequently ended up lost before. - Generally things are working now and I'd consider this in testing.
17 lines
515 B
Text
17 lines
515 B
Text
FILE_NEW
|
|
file #0, 0, 0
|
|
FILE_BOF_BUFFER
|
|
%PDF-1.4^M%\xe2
|
|
MIME_TYPE
|
|
application/pdf
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_OVER_NEW_CONNECTION
|
|
FILE_STATE_REMOVE
|
|
file #0, 498668, 0
|
|
[orig_h=10.45.179.94, orig_p=19950/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
|
|
[orig_h=10.45.179.94, orig_p=19953/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
|
|
total bytes: 498668
|
|
source: HTTP
|
|
MD5: 94046a5fb1c5802d0f1e6d704cf3e10e
|
|
SHA1: 250aa71dd1594363bc7083d25cfd0240e441b119
|
|
SHA256: 5c3bc213c9eff85f98feceac8810b955f8415564e50e3889b447e847c50c5ba7
|