base/protocols/conn/contents.zeek

Conn

This script can be used to extract either the originator’s data or the responders data or both. By default nothing is extracted, and in order to actually extract data the c$extract_orig and/or the c$extract_resp variable must be set to T. One way to achieve this would be to handle the connection_established event elsewhere and set the extract_orig and extract_resp options there. However, there may be trouble with the timing due to event queue delay.

Note

This script does not work well in a cluster context unless it has a remotely mounted disk to write the content files to.

Namespace

Conn

Imports

base/utils/files.zeek

Summary

Runtime Options

Conn::default_extract: bool &redef

If this variable is set to T, then all contents of all connections will be extracted.

Conn::extraction_prefix: string &redef

The prefix given to files containing extracted connections as they are opened on disk.

Redefinitions

connection: record

New Fields

connection

extract_orig: bool &default = Conn::default_extract &optional

extract_resp: bool &default = Conn::default_extract &optional

Detailed Interface

Runtime Options

Conn::default_extract
Type

bool

Attributes

&redef

Default

F

If this variable is set to T, then all contents of all connections will be extracted.

Conn::extraction_prefix
Type

string

Attributes

&redef

Default

"contents"

The prefix given to files containing extracted connections as they are opened on disk.