I have noticed that in many app level analyzers there is a sort of "safety check" in the method DeliverStream which essentially returns when the tcp session is partial, i.e.
if ( TCP() && TCP()->IsPartial() )
This is true for example for the HTTP, SSH, SSL analyzers and more. My understanding is that this is to prevent app layer analyzers or scripts relying on them from breaking down or missing some information when processing packets with possible missing bytes.
Am I right? How much reliable is this check TCP()->IsPartial() for partial tcp sessions in the tcp analyzer?
Hi, I've been trying to install this plugin and it seems to have
some issues or confusion between bro and zeek for that plugin.
Anyone encountered this issue?
~]# zkg install apache/metron-bro-plugin-kafka
The following packages will be INSTALLED:
Verify the following REQUIRED external dependencies:
(Ensure their installation on all relevant systems before proceeding):
from zeek/apache/metron-bro-plugin-kafka (0.3):
zeek/apache/metron-bro-plugin-kafka asks for LIBRDKAFKA_ROOT (Path to
librdkafka installation tree) ? [/usr/local/lib]
Saved answers to config file: /root/.zkg/config
Running unit tests for "zeek/apache/metron-bro-plugin-kafka"
error: failed to run tests for zeek/apache/metron-bro-plugin-kafka: package
build_command failed, see log in
Proceed to install anyway? [N/y]
~]# cat /root/.zkg/logs/metron-bro-plugin-kafka-build.log
=== STDERR ===
=== STDOUT ===
Cannot determine Bro source directory, use --bro-dist=DIR.
I have a Zeek script that I would like to add optional Broker functionality
to. I don't want it to be a requirement, so I'm adding run-time redef
options that can be toggled to enable/disable it.
const broker_enable = F &redef;
When I attempt to add this line to my local.bro/zeek file after the @load
redef MODULE::broker_enable = T;
It won't override broker_enable and thus doesn't listen on the socket. I
assume that it's because the @load happens before the redef in local.bro,
and thus doesn't override when it checks for the @if ?
Is there a better way that I can do this? Like checking if Broker is
actually available? I tried this, but it doesn't work either:
print "Broker Enabled";
Thanks in advance,