zeek/scripts/base
Justin Azoff e8de3de2d4 Optimize software found cluster communication
As a followup to 3bf8c8ceb6 that added the
parse cache, add a small short lived cache on the workers to effectively
debounce the number of Software::new events sent up to the proxies.

User-Agents are highly repetitive, workers often see exact duplicate
user-agents on the same orig_h. Worse, due to NAT, virtualization, and
the proliferation of Electron based applications, variations of the same
user-agent can be seen at the same time.  For example:

	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.18 Safari/537.36 Zoom/6.2.0 (1855)

When these two user-agents are seen concurrently, the software framework
will log each flip as a new user-agent. This can be fixed separately on
the proxy side, but a reduction of Software::new events is still needed
to reduce cluster communication overhead as well as the load on the
proxies.

With a 10 minute cache on the workers, this should greatly reduce the
number of redundant user-agents logged in the software.log
2025-05-02 10:14:19 -04:00
..
files Copy timestamp from file object 2024-05-17 15:03:06 +02:00
frameworks Optimize software found cluster communication 2025-05-02 10:14:19 -04:00
misc Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
packet-protocols Add analyzer registration from VLAN to VNTAG 2025-03-18 11:51:27 -07:00
protocols Merge remote-tracking branch 'origin/topic/timw/update-ct-ca-lists' 2025-04-29 08:53:04 -07:00
utils Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
init-bare.zeek Merge branch 'topic/christian/broker-backpressure-metrics' 2025-04-25 10:04:09 -07:00
init-default.zeek Lay out initial parts for the Storage framework 2025-03-18 09:32:34 -07:00
init-frameworks-and-bifs.zeek Minor comment tweaks for init-frameworks-and-bifs.zeek 2024-10-18 09:56:29 -07:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00