Skip to content
This repository has been archived by the owner on Apr 16, 2021. It is now read-only.

securityonion-elsa-extras: update bro_conn parser for Bro 2.4 #762

Closed
dougburks opened this issue Jun 23, 2015 · 3 comments
Closed

securityonion-elsa-extras: update bro_conn parser for Bro 2.4 #762

dougburks opened this issue Jun 23, 2015 · 3 comments

Comments

@dougburks
Copy link
Contributor

From https://www.bro.org/download/NEWS.bro.html:
"conn.log gained a new field local_resp that works like local_orig, just for the responder address of the connection."

OLD conn.log

fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_cc resp_cc sensorname

NEW Bro 2.4 conn.log with local_resp:

fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_cc resp_cc sensorname

@dougburks
Copy link
Contributor Author

@dougburks
Copy link
Contributor Author

@dougburks
Copy link
Contributor Author

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant