mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
46 lines
1.1 KiB
Text
46 lines
1.1 KiB
Text
# $Id: udp-common.bro 4758 2007-08-10 06:49:23Z vern $
|
|
#
|
|
# Performs generic UDP request/reply processing, but doesn't set
|
|
# the packet filter to capture all UDP traffic (use udp.bro for that).
|
|
|
|
@load hot
|
|
@load conn
|
|
@load scan
|
|
|
|
global udp_req_count: table[conn_id] of count &default = 0;
|
|
global udp_rep_count: table[conn_id] of count &default = 0;
|
|
|
|
event udp_request(u: connection)
|
|
{
|
|
Scan::check_scan(u, F, F);
|
|
# if ( TRW::use_TRW_algorithm )
|
|
# TRW::check_TRW_scan(u, conn_state(u, udp), F);
|
|
|
|
Hot::check_hot(u, Hot::CONN_ATTEMPTED);
|
|
}
|
|
|
|
event udp_reply(u: connection)
|
|
{
|
|
Scan::check_scan(u, T, F);
|
|
# if ( TRW::use_TRW_algorithm )
|
|
# TRW::check_TRW_scan(u, conn_state(u, udp), F);
|
|
|
|
Hot::check_hot(u, Hot::CONN_ESTABLISHED);
|
|
Hot::check_hot(u, Hot::CONN_FINISHED);
|
|
}
|
|
|
|
function add_req_rep_addl(u: connection)
|
|
{
|
|
local id = u$id;
|
|
if ( udp_req_count[id] > 1 || udp_rep_count[id] > 1 )
|
|
append_addl(u, fmt("[%d/%d]", udp_req_count[id], udp_rep_count[id]));
|
|
|
|
delete udp_req_count[id];
|
|
delete udp_rep_count[id];
|
|
}
|
|
|
|
event udp_session_done(u: connection)
|
|
{
|
|
add_req_rep_addl(u);
|
|
Hot::check_hot(u, Hot::CONN_FINISHED);
|
|
}
|