mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
7c48aad582
DTLS now only outputs protocol violations once it saw something that looked like a DTLS connection (at least a client hello). Before the danger that it misinterprets something is too high. It has a configurable number of invalid packets that it can skip over (because other protocols might be interleaved with the connection) and a maximum amount of Protocol violations that it outputs because of wrong packet versions.
15 lines
438 B
Text
15 lines
438 B
Text
# This tests checks that non-dtls connections to which we attach don't trigger tons of errors.
|
|
|
|
# @TEST-EXEC: bro -C -r $TRACES/dns-txt-multiple.trace %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
event bro_init()
|
|
{
|
|
const add_ports = { 53/udp };
|
|
Analyzer::register_for_ports(Analyzer::ANALYZER_DTLS, add_ports);
|
|
}
|
|
|
|
event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, reason: string)
|
|
{
|
|
print c$id, atype, reason;
|
|
}
|