search

corelight / zeek-community-id

Zeek support for Community ID flow hashing.
https://github.com/corelight/community-id-spec
Other
33 stars 18 forks source link

Switch connection handling to new_connection() #19

Open ckreibich opened 3 years ago

ckreibich commented 3 years ago

Establishing the connection state early has the benefit that code grabbing/logging the connection info sees the ID prior to the connection's state expiration.

@JustinAzoff, fyi!

JustinAzoff commented 3 years ago

yep.. and if you want a good test to ensure that this works. run it with https://github.com/corelight/zeek-long-connections and see if you get the community id stuff in the conn_long log.