mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 17:48:21 +00:00
b51dd191d7
UDP tunnel support removed for now, to be re-added in specific analyzers later, but IP-in-IP is now decapsulated recursively so nested tunnels can be seen and the inner packets get sent through the IP fragment reassembler if necessary.
30 lines
923 B
Text
30 lines
923 B
Text
# @TEST-EXEC: bro -b -r $TRACES/tunnels/6in6.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/6in6in6.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/6in4.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/4in6.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/4in4.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: bro -b -r $TRACES/tunnels/6in6-tunnel-change.pcap %INPUT >>output 2>&1
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
if ( c?$tunnel )
|
|
{
|
|
print "new_connection: tunnel";
|
|
print fmt(" conn_id: %s", c$id);
|
|
print fmt(" encap: %s", c$tunnel);
|
|
}
|
|
else
|
|
{
|
|
print "new_connection: no tunnel";
|
|
}
|
|
}
|
|
|
|
event tunnel_changed(c: connection, e: encapsulating_conns)
|
|
{
|
|
print "tunnel_changed:";
|
|
print fmt(" conn_id: %s", c$id);
|
|
if ( c?$tunnel )
|
|
print fmt(" old: %s", c$tunnel);
|
|
print fmt(" new: %s", e);
|
|
}
|