zeek/policy/protocols/mime/file-ident.bro
Seth Hall 9f22a882cd Updates to mime scripts based on comments from Robin.
- Removed reverse dependency of mime loading smtp.
- Extracting filename correctly now.
- Now copes with mime_end_entity dual firing bug.
- File hashing interface more similar to other file
  hashing interfaces.
- New notice for when a hash is calculated.
2011-06-17 21:49:23 -04:00

16 lines
335 B
Text

@load mime/base
module MIME;
export {
redef record Info += {
## Sniffed MIME type for the transfer.
mime_type: string &log &optional;
};
}
event mime_segment_data(c: connection, length: count, data: string) &priority=7
{
if ( c$mime$content_len == 0 )
c$mime$mime_type = split1(identify_data(data, T), /;/)[1];
}