mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 11:38:20 +00:00
ea1616bed5
That means that, for example, connections that are terminated with an alert during the handshake never appear in the ssl.log. This patch changes this behavior - now all ssl connections that fire any event are logged. The protocol confirmation of the ssl analyzer is moved to the client_hello instead to the server hello. Furthermore, an additional field is added to ssl.log, which indicates if a connection has been established or not (which probably indicates a handshake problem).
10 lines
573 B
Text
10 lines
573 B
Text
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path ssl
|
|
#open 2014-03-04-21-57-58
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version cipher server_name session_id subject issuer_subject not_valid_before not_valid_after last_alert client_subject client_issuer_subject established
|
|
#types time string addr port addr port string string string string string string time time string string string bool
|
|
1393957586.786031 CXWv6p3arKYeMETxOg 192.168.4.149 53525 74.125.239.37 443 - - - - - - - - handshake_failure - - F
|
|
#close 2014-03-04-21-57-58
|