zeek/scripts/base/frameworks
Justin Azoff e8de3de2d4 Optimize software found cluster communication
As a followup to 3bf8c8ceb6 that added the
parse cache, add a small short lived cache on the workers to effectively
debounce the number of Software::new events sent up to the proxies.

User-Agents are highly repetitive, workers often see exact duplicate
user-agents on the same orig_h. Worse, due to NAT, virtualization, and
the proliferation of Electron based applications, variations of the same
user-agent can be seen at the same time.  For example:

	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.18 Safari/537.36 Zoom/6.2.0 (1855)

When these two user-agents are seen concurrently, the software framework
will log each flip as a new user-agent. This can be fixed separately on
the proxy side, but a reduction of Software::new events is still needed
to reduce cluster communication overhead as well as the load on the
proxies.

With a 10 minute cache on the workers, this should greatly reduce the
number of redundant user-agents logged in the software.log
2025-05-02 10:14:19 -04:00
..
analyzer Remove violating analyzer from services field again 2025-03-04 15:10:49 +00:00
broker Lower listen/connect retry intervals in Broker and the cluster framework to 1sec 2025-04-25 10:22:35 -07:00
cluster Lower listen/connect retry intervals in Broker and the cluster framework to 1sec 2025-04-25 10:22:35 -07:00
config config: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
control annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
files Move python signatures to a separate file 2024-12-09 11:08:30 -07:00
input Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
intel intel: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
logging Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
netcontrol netcontrol: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
notice Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
openflow openflow: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
packet-filter Add PacketFilter::remove_exclude function 2024-04-17 21:25:35 +00:00
reporter Support for log filter policy hooks 2020-09-30 12:32:45 -07:00
signatures allow signature actions to be dynamically updated 2023-07-13 17:25:32 -07:00
software Optimize software found cluster communication 2025-05-02 10:14:19 -04:00
spicy Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
storage Add STORAGE_ prefixes for backends and serializers 2025-04-14 10:11:13 -07:00
sumstats sumstats: Move to Cluster::publish() 2024-12-12 17:54:42 +01:00
supervisor Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
telemetry Fix errors from rst linting on the generated docs 2025-01-24 11:41:36 -07:00
tunnels Add GTPv1 packet analyzer, disable old analyzer 2021-11-23 19:36:50 -07:00