zeek-dev October 2012

zeek-dev@lists.zeek.org

82 discussions

[Bro-Dev] #911: SRV replies don't get processed by DNS analyzer

by Bro Tracker

#911: SRV replies don't get processed by DNS analyzer ---------------------+------------------------ Reporter: vern | Owner: Type: Problem | Status: new Priority: Normal | Milestone: Bro2.2 Component: Bro | Version: git/master Keywords: | ---------------------+------------------------ The event engine doesn't appear to generate {{{dns_SRV_reply}}} in some cases, as indicated by running on the attached trace. I've tried this with both the default DNS analysis and my own custom analysis (that uses -b to not run other stuff) and have confirmed that the reply event isn't getting generated, even though there aren't any checksum issues or such. -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/911> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

9 years, 7 months

[Bro-Dev] #876: BroControl "diag" emails

by Bro Tracker

#876: BroControl "diag" emails -----------------------------+------------------------ Reporter: seth | Owner: dnthayer Type: Feature Request | Status: new Priority: Normal | Milestone: Bro2.2 Component: BroControl | Version: git/master Keywords: | -----------------------------+------------------------ The BroControl "diag" emails should have a stanza at the beginning about recommending that the email be forwarded to a crash-specific mailing list for us to try and debug problems better. Robin's suggested wording was along these lines {{{ we could put a sentence at the the beignning of the mail that says "if you want to help us debug this problem, please forward this mail to XXX", perhaps with a reply-to accordingly set. }}} -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/876> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] #909: topic/seth/pppoe

by Bro Tracker

#909: topic/seth/pppoe ---------------------------+------------------------ Reporter: seth | Owner: robin Type: Merge Request | Status: new Priority: Normal | Milestone: Bro2.2 Component: Bro | Version: git/master Keywords: | ---------------------------+------------------------ Support for IP in PPPoE along with a test. -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/909> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] #888: Bro crashes on IPv6 subnet [::FFFF:0:0]/96

by Bro Tracker

#888: Bro crashes on IPv6 subnet [::FFFF:0:0]/96 --------------------------+--------------------- Reporter: sheharbano.k | Type: Problem Status: new | Priority: High Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: --------------------------+--------------------- Bro cannot handle the subnet [::FFFF:0:0]/96 (IPv4 mapped IPv6 addresses- sec 2.2 of rfc5156). The error message says: internal error: Bad IPAddr(v4) IPPrefix length : 96 Aborted Works fine on other subnets. --------------------------------- test.bro --------------------------------- event bro_init() { local snet = [::FFFF:0:0]/96; #local snet = [1::]/96; print snet; } -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/888> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] #906: Need tcp_max_above_hole_without_any_acks to be redefinable

by Bro Tracker

#906: Need tcp_max_above_hole_without_any_acks to be redefinable ------------------------+--------------------- Reporter: carsten | Type: Problem Status: new | Priority: Normal Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- In my scripts, I must redefine tcp_max_above_hole_without_any_acks from scripts/base/init-bare.bro. Currently I have to patch the source for doing it, as the constant is not redefinable from a script. The fun thing is: the documentation even says "If set to zero, then we don’t ever give up.", which you currently cannot do from scripts. Please change inside scripts/base/init-bare.bro from const tcp_max_above_hole_without_any_acks = 4096; to const tcp_max_above_hole_without_any_acks = 4096 &redef; -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/906> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] #907: Need tcp_excessive_data_without_further_acks to be redefinable

by Bro Tracker

#907: Need tcp_excessive_data_without_further_acks to be redefinable ------------------------+--------------------- Reporter: carsten | Type: Problem Status: new | Priority: Normal Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- In my scripts, I must redefine tcp_excessive_data_without_further_acks from scripts/base/init-bare.bro. Currently I have to patch the source for doing it, as the constant is not redefinable from a script. The fun thing is: the documentation even says "If set to zero, then we don’t ever give up.", which you currently cannot do from scripts. Please change inside scripts/base/init-bare.bro from const tcp_excessive_data_without_further_acks = 10 * 1024 * 1024; to const tcp_excessive_data_without_further_acks = 10 * 1024 * 1024 &redef; -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/907> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] #905: Need tcp_max_initial_window to be redefinable

by Bro Tracker

#905: Need tcp_max_initial_window to be redefinable ------------------------+--------------------- Reporter: carsten | Type: Problem Status: new | Priority: Normal Milestone: Bro2.2 | Component: Bro Version: git/master | Keywords: ------------------------+--------------------- In my scripts, I must redefine tcp_max_initial_window from scripts/base /init-bare.bro. Currently I have to patch the source for doing it, as the constant is not redefinable from a script. The fun thing is: the documentation even says "Set to zero to turn off this determination.", which you currently cannot do from scripts. Please change inside scripts/base/init-bare.bro from const tcp_max_initial_window = 4096; to const tcp_max_initial_window = 4096 &redef; -- Ticket URL: <http://tracker.bro-ids.org/bro/ticket/905> Bro Tracker <http://tracker.bro-ids.org/bro> Bro Issue Tracker

9 years, 7 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

9 years, 7 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

9 years, 7 months

← Newer
1
2
3
4
5
6
7
8
9
Older →

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev October 2012