zeek/scripts/base/protocols
Jon Siwek 8dad5026fd File type detection changes and fix https.log {orig,resp}_fuids fields.
- Removed "binary" and "octet-stream" mime type detections. They don't
  provide any more information than an uninitialized mime_type field
  which implicitly means no magic signature matches and so the media
  type is unknown to Bro.

- Slight change to "text/plain" signature.  It's still not the most
  accurate, which is reflected in its -20 strength value.

- The logic for adding file ids to {orig,resp}_fuids fields of
  the http.log incorrectly depended on the state of
  {orig,resp}_mime_types fields, so sometimes not all file ids
  associated w/ the session were logged.
2014-03-25 12:44:11 -05:00
..
conn Add README files for base/protocols 2013-10-17 12:47:32 -05:00
dhcp Integrate new Broxygen functionality into Sphinx. 2013-11-21 14:34:32 -06:00
dnp3 Add README files for base/protocols 2013-10-17 12:47:32 -05:00
dns Fix non-deterministic logging of unmatched DNS msgs, addresses BIT-1153 2014-03-10 11:34:57 -05:00
ftp Add README files for base/protocols 2013-10-17 12:47:32 -05:00
http File type detection changes and fix https.log {orig,resp}_fuids fields. 2014-03-25 12:44:11 -05:00
irc Add README files for base/protocols 2013-10-17 12:47:32 -05:00
modbus Add README files for base/protocols 2013-10-17 12:47:32 -05:00
pop3 Add README files for base/protocols 2013-10-17 12:47:32 -05:00
smtp Tweak to SMTP script to adjust for new string slicing behaviour. 2013-12-04 13:45:46 -08:00
socks Add README files for base/protocols 2013-10-17 12:47:32 -05:00
ssh Remove resp_size from the log. Refactor when we write out to the log a bit. Geodata now works reliably. 2013-11-05 11:58:00 -05:00
ssl only call disable_analyzer if the connection is still open. 2014-03-04 15:09:19 -08:00
syslog Add README files for base/protocols 2013-10-17 12:47:32 -05:00
tunnels Moved DPD signatures into script specific directories. 2013-07-09 22:44:55 -04:00