Table of Contents
zeekctl
conn.log
ip_proto
uid
dns.log
http.log
files.log
ftp.log
ssl.log
x509.log
smtp.log
pe.log
net user
irc.log
ldap.log
ldap_search.log
rdp.log
traceroute.log
known_certs.log
known_hosts.log
known_services.log
software.log
weird.log
notice.log
capture_loss.log
reporter.log
stats.log
prof.log
conn_id_ctx
init-plugin
When the ZIP analyzer hits a limit (and stops forwarding data to other analyzers), it triggers an event. This script reacts to the event in order to trigger the weird and mark the connection with an ‘X’.