zeek/testing/btest/Baseline/scripts.base.protocols.conn.polling
Jon Siwek 68aead024a Add an example of a GridFTP data channel detection script.
It relies on the heuristics of GridFTP data channels commonly default to
SSL mutual authentication with a NULL bulk cipher and that they usually
transfer large datasets (default threshold of script is 1 GB).  The
script also defaults to skip_further_processing() after detection to try
to save cycles analyzing the large, benign connection.

Also added a script in base/protocols/conn/polling that generalizes the
process of polling a connection for interesting features.  The GridFTP
data channel detection script depends on it to monitor bytes
transferred.
2012-10-01 12:32:24 -05:00
..
out1 Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00
out2 Add an example of a GridFTP data channel detection script. 2012-10-01 12:32:24 -05:00