mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
b3f1f45082
Internally, all BROv6 preprocessor switches were removed and addr/subnet representations wrapped in the new IPAddr/IPPrefix classes. Some script-layer changes of note: - dns_AAAA_reply event signature changed: the string representation of an IPv6 addr is easily derived from the addr value, it doesn't need to be another parameter. This event also now generated directly by the DNS analyzer instead of being "faked" into a dns_A_reply event. - removed addr_to_count BIF. It used to return the host-order count representation of IPv4 addresses only. To make it more generic, we might later add a BIF to return a vector of counts in order to support IPv6. - changed the result of enclosing addr variables in vertical pipes (e.g. |my_addr|) to return the bit-width of the address type which is 128 for IPv6 and 32 for IPv4. It used to function the same way as addr_to_count mentioned above. - remove bro_has_ipv6 BIF
10 lines
362 B
Text
10 lines
362 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path metrics
|
|
#fields ts metric_id filter_name index.host index.str index.network value
|
|
#types time enum string addr string subnet count
|
|
1328303763.333948 TEST_METRIC foo-bar 6.5.4.3 - - 2
|
|
1328303763.333948 TEST_METRIC foo-bar 7.2.1.5 - - 1
|
|
1328303763.333948 TEST_METRIC foo-bar 1.2.3.4 - - 3
|