zeek/testing/btest/Traces/tcp/synack.pcap
Arne Welzel be061bfe04 IPBasedAnalyzer: Ensure a connection's ConnVal is updated
One idea for the issue that a connection record's endpoint fields may be stale
when events are raised before the ConnSize analyzer saw the packet and no
analyzer calls GetVal() for the connection afterwards.

While this looks a bit ad hoc, I'm leaning towards a follow-up, extending
GetVal(skip_update_connval=false) API and then updating BinPAC/Spicy to
generate code that passes ``false``. That could avoid a number of unnecessary
UpateConnVal() invocations when calling GetVal() multiple times for the
same connection and instead just do it once when the packet has been
processed.

Closes #4214
2025-08-22 14:15:34 +02:00

114 B