mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 02:58:20 +00:00
bd9855a380
If 'use_conn_size_analyzer' is true, the event engine tracks number of packets and raw IP bytes per connection. If report_conn_size_analyzer is true, these values are included as four new columns into conn.log I changed conn.bro so that the value of report_conn_size_analyzer follows that of use_conn_size_analyzer. For the new conn.log, we probably want to get rid of report_conn_size_analyzer anyway.
41 lines
835 B
C++
41 lines
835 B
C++
// $Id$
|
|
//
|
|
// See the file "COPYING" in the main distribution directory for copyright.
|
|
//
|
|
|
|
#ifndef CONNSTATS_H
|
|
#define CONNSTATS_H
|
|
|
|
#include "Analyzer.h"
|
|
#include "NetVar.h"
|
|
|
|
|
|
class ConnSize_Analyzer : public Analyzer {
|
|
public:
|
|
ConnSize_Analyzer(Connection* c);
|
|
virtual ~ConnSize_Analyzer();
|
|
|
|
virtual void Init();
|
|
virtual void Done();
|
|
|
|
// from Analyzer.h
|
|
virtual void UpdateConnVal(RecordVal *conn_val);
|
|
virtual void FlipRoles();
|
|
|
|
static Analyzer* InstantiateAnalyzer(Connection* conn)
|
|
{ return new ConnSize_Analyzer(conn); }
|
|
|
|
static bool Available() { return BifConst::use_conn_size_analyzer ; }
|
|
|
|
protected:
|
|
virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
|
|
int seq, const IP_Hdr* ip, int caplen);
|
|
|
|
|
|
uint64_t orig_bytes;
|
|
uint64_t resp_bytes;
|
|
uint64_t orig_pkts;
|
|
uint64_t resp_pkts;
|
|
};
|
|
|
|
#endif
|