mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
52 lines
1.4 KiB
Text
52 lines
1.4 KiB
Text
# $Id: remote-pcap.bro 2704 2006-04-04 07:35:46Z vern $
|
|
#
|
|
# Allows remote peers to set our capture filter.
|
|
|
|
@load remote
|
|
|
|
# We install a filter which (hopefully) doesn't match anything to avoid Bro's
|
|
# default "tcp or udp" when no other script/peers adds a filter.
|
|
|
|
## FIXME: We need non-blocking pacp for this to work.
|
|
##
|
|
## ##redef capture_filters["match-nothing"] = "ether src 0:0:0:0:0:0";
|
|
|
|
function build_capture_filter_index(p: event_peer): string
|
|
{
|
|
return fmt("remote-%d", p$id);
|
|
}
|
|
|
|
event remote_capture_filter(p: event_peer, filter: string)
|
|
{
|
|
# If we send a capture filter to a peer and are subscribed to all
|
|
# of its events, we will get a remote_capture_filter event back.
|
|
if ( is_remote_event() )
|
|
return;
|
|
|
|
Remote::do_script_log(p, fmt("received capture filter: %s", filter));
|
|
|
|
capture_filters[build_capture_filter_index(p)] = filter;
|
|
|
|
# This will recompile the filter, which may take some time.
|
|
# Thus, setting a new capture_filter may cost us some packets :-(.
|
|
update_default_pcap_filter();
|
|
|
|
Remote::do_script_log(p, fmt("new default pcap filter: %s",
|
|
default_pcap_filter));
|
|
}
|
|
|
|
event remote_connection_closed(p: event_peer)
|
|
{
|
|
local i = build_capture_filter_index(p);
|
|
|
|
if ( i in capture_filters )
|
|
{
|
|
Remote::do_script_log(p, fmt("removed capture filter: %s",
|
|
capture_filters[i]));
|
|
delete capture_filters[i];
|
|
update_default_pcap_filter();
|
|
}
|
|
|
|
Remote::do_script_log(p, fmt("new default pcap filter: %s",
|
|
default_pcap_filter));
|
|
}
|