-
Notifications
You must be signed in to change notification settings - Fork 1.2k
/
speculative-service.zeek
37 lines (29 loc) · 1.03 KB
/
speculative-service.zeek
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
##! This script adds information about matched DPD signatures to the connection
##! log.
@load base/protocols/conn
module Conn;
redef record Info += {
## Protocol that was determined by a matching signature after the beginning
## of a connection. In this situation no analyzer can be attached and hence
## the data cannot be analyzed nor the protocol can be confirmed.
speculative_service: string &log &optional;
};
redef record connection += {
speculative_service: set[string] &default=string_set();
};
redef dpd_match_only_beginning = F;
redef dpd_late_match_stop = T;
hook finalize_speculative_service(c: connection)
{
local sp_service = "";
for ( s in c$speculative_service )
sp_service = sp_service == "" ? s : cat(sp_service, ",", s);
if ( sp_service != "" )
c$conn$speculative_service = to_lower(sp_service);
}
event protocol_late_match(c: connection, atype: Analyzer::Tag)
{
local analyzer = Analyzer::name(atype);
add c$speculative_service[analyzer];
Conn::register_removal_hook(c, finalize_speculative_service);
}