Zeek_ZIP.events.bif.zeek

GLOBAL

Namespace:: GLOBAL

Summary

Events

zip_analyzer_stats: event

Generated when the ZIP support analyzer is done forwarding data, once per analyzer that sees compressed traffic.

Detailed Interface

Events

zip_analyzer_stats 

Type:: event (c: connection, aid: count, total_in: count, total_out: count, exceeded: bool)

Generated when the ZIP support analyzer is done forwarding data, once per analyzer that sees compressed traffic. This is not a ZIP file analyzer, instead used by some analyzers (HTTP, IRC) for compressed content.

Parameters:

c – The connection.
aid – The analyzer identifier of the ZIP analyzer.
total_in – The total number of compressed input bytes handled by the ZIP analyzer.
total_out – The total number of uncompressed output bytes handled by the ZIP analyzer. This is capped if the limit is exceeded.
exceeded – True if this stream exceeded either HTTP::max_uncompressed_size or IRC::max_uncompressed_size, depending on the parent analyzer. If so, total_out will not exceed that cap. False if the cap was not exceeded.