zeek/scripts
Jon Siwek 68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
..
base Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
policy Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
site Add @load-sigs directive for loading signature files (addresses #551). 2012-06-01 14:10:23 -05:00
CMakeLists.txt Don't install test-all-policy.bro script as it's for testing only. 2011-10-12 12:42:12 -05:00
test-all-policy.bro Merge remote-tracking branch 'origin/fastpath' 2012-07-27 12:55:10 -07:00