zeek/policy/udp-common.bro

46 lines
1.1 KiB
Text

# $Id: udp-common.bro 4758 2007-08-10 06:49:23Z vern $
#
# Performs generic UDP request/reply processing, but doesn't set
# the packet filter to capture all UDP traffic (use udp.bro for that).
@load hot
@load conn
@load scan
global udp_req_count: table[conn_id] of count &default = 0;
global udp_rep_count: table[conn_id] of count &default = 0;
event udp_request(u: connection)
{
Scan::check_scan(u, F, F);
# if ( TRW::use_TRW_algorithm )
# TRW::check_TRW_scan(u, conn_state(u, udp), F);
Hot::check_hot(u, Hot::CONN_ATTEMPTED);
}
event udp_reply(u: connection)
{
Scan::check_scan(u, T, F);
# if ( TRW::use_TRW_algorithm )
# TRW::check_TRW_scan(u, conn_state(u, udp), F);
Hot::check_hot(u, Hot::CONN_ESTABLISHED);
Hot::check_hot(u, Hot::CONN_FINISHED);
}
function add_req_rep_addl(u: connection)
{
local id = u$id;
if ( udp_req_count[id] > 1 || udp_rep_count[id] > 1 )
append_addl(u, fmt("[%d/%d]", udp_req_count[id], udp_rep_count[id]));
delete udp_req_count[id];
delete udp_rep_count[id];
}
event udp_session_done(u: connection)
{
add_req_rep_addl(u);
Hot::check_hot(u, Hot::CONN_FINISHED);
}