mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
4281d704c1
With private addresses treated as local ones, this picked up some private-range flows in the test pcap involved.
29 lines
979 B
Text
29 lines
979 B
Text
# @TEST-EXEC: zeek -b -r $TRACES/wikipedia.trace %INPUT
|
|
# @TEST-EXEC: btest-diff local.log
|
|
# @TEST-EXEC: btest-diff remote.log
|
|
#
|
|
# The record value passed into the path_func should be allowed to contain a
|
|
# subset of the fields in the stream's columns.
|
|
|
|
@load base/utils/site
|
|
@load base/protocols/conn
|
|
@load base/frameworks/notice
|
|
|
|
# Don't automatically treat private address space as local here so we filter
|
|
# precisely on a single local prefix:
|
|
redef Site::private_address_space_is_local = F;
|
|
redef Site::local_nets = {141.142.0.0/16};
|
|
|
|
function split_log(id: Log::ID, path: string, rec: record {id:conn_id;}): string
|
|
{
|
|
return Site::is_local_addr(rec$id$orig_h) ? "local" : "remote";
|
|
}
|
|
|
|
event zeek_init()
|
|
{
|
|
# Add a new filter to the Conn::LOG stream that logs only
|
|
# timestamp and originator address.
|
|
local filter: Log::Filter = [$name="dst-only", $path_func=split_log,
|
|
$include=set("ts", "id.orig_h")];
|
|
Log::add_filter(Conn::LOG, filter);
|
|
}
|