mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
af1714853f
When http_reply events are received before http_request events, either through faking traffic or possible re-ordering, it is possible to trigger unbounded state growth due to later http_requests never being matched again with responses. Prevent this by synchronizing request/response counters when late requests come in. Also forcefully flush pending requests when http_replies are never observed either due to the analyzer having been disabled or because half-duplex traffic. Fixes #1705 |
||
|---|---|---|
| .. | ||
| actions | ||
| __load__.zeek | ||
| main.zeek | ||
| README | ||
| weird.zeek | ||
The notice framework enables Zeek to "notice" things which are odd or potentially bad, leaving it to the local configuration to define which of them are actionable. This decoupling of detection and reporting allows Zeek to be customized to the different needs that sites have.