base/init-bare.zeek
- Analyzer
- BinPAC
- Cluster
- DCE_RPC
- DHCP
- FTP
- GLOBAL
- HTTP
- JSON
- KRB
- MIME
- MOUNT3
- MQTT
- NCP
- NFS3
- NTLM
- NTP
- PE
- POP3
- Pcap
- RADIUS
- RDP
- Reporter
- SMB
- SMB1
- SMB2
- SMTP
- SNMP
- SOCKS
- SSH
- SSL
- TCP
- Telemetry
- Threading
- Tunnel
- UnknownProtocol
- WebSocket
- Weird
- X509
- Namespaces
Analyzer, BinPAC, Cluster, DCE_RPC, DHCP, FTP, GLOBAL, HTTP, JSON, KRB, MIME, MOUNT3, MQTT, NCP, NFS3, NTLM, NTP, PE, POP3, Pcap, RADIUS, RDP, Reporter, SMB, SMB1, SMB2, SMTP, SNMP, SOCKS, SSH, SSL, TCP, Telemetry, Threading, Tunnel, UnknownProtocol, WebSocket, Weird, X509
- Imports
base/bif/CPP-load.bif.zeek, base/bif/communityid.bif.zeek, base/bif/const.bif.zeek, base/bif/event.bif.zeek, base/bif/mmdb.bif.zeek, base/bif/option.bif.zeek, base/bif/packet_analysis.bif.zeek, base/bif/plugins/Zeek_KRB.types.bif.zeek, base/bif/plugins/Zeek_SNMP.types.bif.zeek, base/bif/reporter.bif.zeek, base/bif/stats.bif.zeek, base/bif/strings.bif.zeek, base/bif/supervisor.bif.zeek, base/bif/types.bif.zeek, base/bif/zeek.bif.zeek, base/frameworks/spicy/init-bare.zeek, base/frameworks/supervisor/api.zeek, base/packet-protocols
Summary
Runtime Options
The maximum payload size to allocate for the purpose of
payload information in |
|
How long a weird of a given type is allowed to keep state/counters in memory. |
|
Rate-limits weird names in the table globally instead of per connection/flow. |
|
The rate-limiting sampling rate. |
|
How many weirds of a given type to tolerate before sampling begins. |
|
Prevents rate-limiting sampling of any weirds named in the table. |
|
Default amount of bytes that file analysis will buffer in order to use for mime type matching. |
|
Default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file. |
|
Checksums are ignored for all packets with a src address within this set of networks. |
|
Whether ports given in |
|
Defines UDP ports (source or destination) for which the contents of
either originator or responder streams should be delivered via
|
Redefinable Options
Maximum capacity, in bytes, that the BinPAC flowbuffer is allowed to grow to for use with incremental parsing of a given connection/analyzer. |
|
The initial capacity, in bytes, that will be allocated to the BinPAC flowbuffer of a given connection/analyzer. |
|
The threshold, in bytes, at which the BinPAC flowbuffer of a given
connection/analyzer will have its capacity contracted to
|
|
The maximum number of simultaneous fragmented commands that the DCE_RPC analyzer will tolerate before the it will generate a weird and skip further input. |
|
The maximum number of fragmented bytes that the DCE_RPC analyzer will tolerate on a command before the analyzer will generate a weird and skip further input. |
|
Lookup table for Upgrade analyzers. |
|
Kerberos keytab file name. |
|
Stop analysis of nested multipart MIME entities if this depth is reached. |
|
The maximum number of bytes to allocate when parsing NCP frames. |
|
If true, |
|
If |
|
If |
|
How many commands a POP3 client may have pending before Zeek forcefully removes the oldest. |
|
How many invalid commands a POP3 client may use before Zeek starts raising analyzer violations. |
|
Number of Mbytes to provide as buffer space when capturing from live interfaces. |
|
Number of bytes to use for buffering file read operations when reading from a PCAP file. |
|
Default timeout for packet sources without file descriptors. |
|
Number of bytes per packet to capture from live interfaces. |
|
Tunable for sending reporter error messages to STDERR. |
|
Tunable for sending reporter info messages to STDERR. |
|
Tunable for sending reporter warning messages to STDERR. |
|
Maximum number of DCE-RPC analyzers per connection before discarding them to avoid unbounded state growth. |
|
The maximum number of messages for which to retain state about offsets, fids, or tree ids within the parser. |
|
A set of file names used as named pipes over SMB. |
|
Maximum number of invalid version errors to report in one DTLS connection. |
|
Number of non-DTLS frames that can occur in a DTLS connection before parsing of the connection is suspended. |
|
Maximum number of Alert messages parsed from an SSL record with content_type alert (21). |
|
Maximum amount of time for CivetWeb HTTP threads to wait for metric callbacks to complete on the IO loop. |
|
Number of CivetWeb threads to use. |
|
The heartbeat interval used by the threading framework. |
|
With this set, the GTP analyzer waits until the most-recent upflow
and downflow packets are a valid GTPv1 encapsulation before
issuing |
|
With this set, the Teredo analyzer waits until it sees both sides
of a connection using a valid Teredo encapsulation before issuing
a |
|
How often to cleanup internal state for inactive IP tunnels (includes GRE tunnels). |
|
The number of tunnel_changed events that will be sent for a connection. |
|
The maximum depth of a tunnel to decapsulate until giving up. |
|
Whether to validate the checksum supplied in the outer UDP header of a VXLAN encapsulation. |
|
The number of bytes to extract from the next header and log in the first bytes field. |
|
How long an analyzer/protocol pair is allowed to keep state/counters in in memory. |
|
The rate-limiting sampling rate. |
|
How many reports for an analyzer/protocol pair will be allowed to raise events before becoming rate-limited. |
|
The WebSocket analyzer consumes and forwards frame payload in chunks to keep memory usage bounded. |
|
Whether to enable DPD on WebSocket frame payload by default. |
|
Whether to use the Spicy WebSocket protocol analyzer. |
|
Whether Zeek will forward network_time to the current time upon observing an idle packet source (or no configured packet source). |
|
Number of bits in UIDs that are generated to identify connections and files. |
|
|
If true, warns about unused event handlers at startup. |
BPF filter the user has set via the -f command line options. |
|
Whether to attempt to automatically detect SYN/FIN/RST-filtered trace and not report missing segments for such connections. |
|
This salt value is used for several message digests in Zeek. |
|
Time to wait before timing out a DNS request. |
|
Size of per-connection buffer used for dynamic protocol detection. |
|
If true, don’t consider any ports for deciding which protocol analyzer to use. |
|
If true, stops signature matching after a late match. |
|
If true, stops signature matching if |
|
Maximum number of per-connection packets that will be buffered for dynamic protocol detection. |
|
Reassemble the beginning of all TCP connections before doing signature matching. |
|
Flag to prevent Zeek from exiting automatically when input is exhausted. |
|
Multiples of |
|
How long to hold onto fragments for possible reassembly. |
|
Seed for hashes computed internally for probabilistic data structures. |
|
If an ICMP flow is inactive, time it out after this interval. |
|
If true, don’t verify checksums, and accept packets that give a length of zero in the IPv4 header. |
|
Ignore certain TCP retransmissions for |
|
How many rounds to go without checking IO sources with file descriptors for readiness by default. |
|
How often to check IO sources with file descriptors for readiness when monitoring with a live packet source. |
|
Ports which the core considers being likely used by servers. |
|
Base time of log rotations in 24-hour time format ( |
|
The maximum number of analyzer violations the core generates before suppressing them for a given analyzer instance. |
|
Maximum string length allowed for calls to the |
|
The maximum number of expired timers to process after processing each new packet. |
|
Default name of the MaxMind ASN database file: |
|
Default name of the MaxMind City database file: |
|
Default name of the MaxMind Country database file: |
|
The directory containing MaxMind DB (.mmdb) files to use for GeoIP support. |
|
Fallback locations for MaxMind databases. |
|
Sets the interval for MaxMind DB file staleness checks. |
|
If a connection belongs to an application that we don’t analyze, time it out after this interval. |
|
Default mode for Zeek’s user-space dynamic packet filter. |
|
If a packet source does not yield packets for this amount of time, it is considered idle. |
|
If true, instantiate connection state when a partial connection (one missing its initial establishment negotiation) is seen. |
|
Description transmitted to remote communication peers for identification. |
|
Frequency associated with packet profiling. |
|
Output mode for packet profiling information. |
|
Update interval for profiling (0 disables). |
|
If a trace file is given with |
|
Whether we want |
|
Time to wait before timing out an RPC request. |
|
Whether Zeek is being run under test. |
|
Maximum size of regular expression groups for signature matching. |
|
Skip HTTP data for performance considerations. |
|
When expiring table entries, wait this amount of time before checking the next chunk of entries. |
|
Check for expired table entries after this amount of time. |
|
When expiring/serializing table entries, don’t work on more than this many table entries at a time. |
|
If true, instantiate connection state when a SYN/ACK is seen but not the
initial SYN (even if |
|
Check up on the result of an initial SYN after this much time. |
|
Wait this long upon seeing an initial SYN before timing out the connection attempt. |
|
Upon seeing a normal connection close, flush state after this much time. |
|
When checking a closed connection for further activity, consider it inactive if there hasn’t been any for this long. |
|
If true, all TCP originator-side traffic is reported via
|
|
If true, all TCP responder-side traffic is reported via
|
|
Defines destination TCP ports for which the contents of the originator stream
should be delivered via |
|
Defines destination TCP ports for which the contents of the responder stream
should be delivered via |
|
If we’ve seen this much data without any of it being acked, we give up on that connection to avoid memory exhaustion due to buffering all that stuff. |
|
If a TCP connection is inactive, time it out after this interval. |
|
If true, pass any undelivered to the signature engine before flushing the state. |
|
If we’re not seeing our peer’s ACKs, the maximum volume of data above a sequence hole that we’ll tolerate before assuming that there’s been a packet drop and we should give up on tracking a connection. |
|
Maximum amount of data that might plausibly be sent in an initial flight (prior to receiving any acks). |
|
Number of TCP segments to buffer beyond what’s been acknowledged already to detect retransmission inconsistencies. |
|
Generate a |
|
For services without a handler, these sets define originator-side ports that still trigger reassembly. |
|
For services without a handler, these sets define responder-side ports that still trigger reassembly. |
|
Upon seeing a RST, flush state after this much time. |
|
After a connection has closed, wait this long for further activity before checking whether to time out its state. |
|
FINs/RSTs must come with this much time or less between them to be considered a “storm”. |
|
Number of FINs/RSTs in a row that constitute a “storm”. |
|
|
If true, output profiling for Time-Machine queries. |
Maximum length of HTTP URIs passed to events. |
|
If true, all UDP originator-side traffic is reported via
|
|
If true, all UDP responder-side traffic is reported via
|
|
Defines UDP destination ports for which the contents of the originator stream
should be delivered via |
|
Defines UDP destination ports for which the contents of the responder stream
should be delivered via |
|
If a UDP flow is inactive, time it out after this interval. |
|
Whether to use the |
|
Zeek’s watchdog interval. |
Constants
Record both originator and responder contents. |
|
Turn off recording of contents. |
|
Record originator contents. |
|
Record responder contents. |
|
An additional record. |
|
An answer record. |
|
An authoritative record. |
|
A query. |
|
Big endian. |
|
Tried to determine endian, but failed. |
|
Little endian. |
|
Endian not yet determined. |
|
Administratively prohibited. |
|
Host unreachable. |
|
Fragment needed. |
|
Network unreachable. |
|
Port unreachable. |
|
Protocol unreachable. |
|
IPv6 authentication header. |
|
IPv6 destination options header. |
|
IPv6 encapsulating security payload header. |
|
IPv6 fragment header. |
|
IPv6 hop-by-hop-options header. |
|
Control message protocol. |
|
ICMP for IPv6. |
|
Group management protocol. |
|
Dummy for IP. |
|
IP encapsulation in IP. |
|
IPv6 header. |
|
IPv6 mobility header. |
|
IPv6 no next header. |
|
Raw IP packet. |
|
IPv6 routing header. |
|
TCP. |
|
User datagram protocol. |
|
Mapping of numerical RPC status codes to readable messages. |
|
Unsigned 32-bit integer. |
|
Unsigned 64-bit integer. |
|
A NULL value. |
|
Signed 64-bit integer. |
|
An IP address. |
|
A NULL value. |
|
A NULL value. |
|
An octet string. |
|
An Object Identifier. |
|
An octet string. |
|
Unsigned 32-bit integer. |
|
Unsigned 32-bit integer. |
|
A NULL value. |
|
Endpoint has closed connection. |
|
Endpoint has finished initial handshake regularly. |
|
Endpoint is still inactive. |
|
Endpoint has sent data but no initial SYN. |
|
Endpoint has sent RST. |
|
Endpoint has sent SYN/ACK. |
|
Endpoint has sent SYN. |
|
ACK. |
|
FIN. |
|
Mask combining all flags. |
|
PUSH. |
|
RST. |
|
SYN. |
|
URG. |
|
Endpoint has sent something. |
|
Endpoint is still inactive. |
|
Holds the filename of the trace file given with |
|
Arguments given to Zeek from the command line. |
State Variables
Set of BPF capture filters to use for capturing, indexed by a user-definable ID (which must be unique). |
|
TODO. |
|
Maximum length of payload passed to discarder functions. |
|
If a DNS request includes more than this many queries, assume it’s non-DNS traffic and do not process it. |
|
For DNS servers in these sets, omit processing the ADDL records they include in their replies. |
|
If true, all DNS ADDL records are skipped. |
|
If true, all DNS AUTH records are skipped. |
|
For DNS servers in these sets, omit processing the AUTH records they include in their replies. |
|
Maximum number of HTTP entity data delivered to events. |
|
Network interfaces to listen on. |
|
TODO. |
|
TODO. |
|
TODO. |
|
TODO. |
|
TODO. |
|
The length of MIME data segments delivered to handlers of
|
|
The number of bytes of overlap between successive segments passed to
|
|
File where packet profiles are logged. |
|
Write profiling info into this file in regular intervals. |
|
Set of BPF filters to restrict capturing, indexed by a user-definable ID (which must be unique). |
|
Definition of “secondary filters”. |
|
|
Signature files to read. |
TODO. |
Types
A hook taking a connection, analyzer tag and analyzer id that can be used to veto disabling protocol analyzers. |
|
Generic analyzer confirmation info record. |
|
Generic analyzer violation info record. |
|
A representation of a Zeek script’s call stack. |
|
A representation of an element in a Zeek script’s call stack. |
|
Statistics about Broker communication. |
|
A pool used for distributing data/work among a set of cluster nodes. |
|
A list of addresses offered by a DHCP server. |
|
DHCP Client FQDN Option information (Option 81) |
|
DHCP Client Identifier (Option 61) .. |
|
A DHCP message. |
|
DHCP Relay Agent Information Option (Option 82) .. |
|
Statistics related to Zeek’s active use of DNS. |
|
A type alias for a vector of encapsulating “connections”, i.e. |
|
Statistics about how many times each event name is queued. |
|
Statistics of file analysis. |
|
Statistics about number of gaps in TCP connections. |
|
AP Options. |
|
The data from the ERROR_MSG message. |
|
A Kerberos host address See RFC 4120. |
|
KDC Options. |
|
The data from the AS_REQ and TGS_REQ messages. |
|
The data from the AS_REQ and TGS_REQ messages. |
|
The data from the SAFE message. |
|
A Kerberos ticket. |
|
Used in a few places in the Kerberos analyzer for elements that have a type and a string value. |
|
MOUNT mnt arguments. |
|
Record summarizing the general results and status of MOUNT3 request/reply pairs. |
|
MOUNT lookup reply. |
|
Statistics of all regular expression matchers. |
|
A vector of boolean values that indicate the setting for a range of modbus coils. |
|
A vector of count values that represent 16bit modbus register values. |
|
NFS reply for remove, rmdir. |
|
NFS direntry. |
|
Vector of NFS direntry. |
|
NFS readdir arguments. |
|
NFS file attributes. |
|
NFS fsstat. |
|
Record summarizing the general results and status of NFSv3 request/reply pairs. |
|
NFS link reply. |
|
NFS link arguments. |
|
NFS lookup reply. |
|
NFS reply for create, mkdir, and symlink. |
|
NFS read reply. |
|
NFS read arguments. |
|
NFS readdir reply. |
|
NFS readdir arguments. |
|
NFS readline reply. |
|
NFS reply for rename. |
|
NFS rename arguments. |
|
NFS sattr reply. |
|
NFS file attributes. |
|
NFS sattr arguments. |
|
NFS symlink arguments. |
|
NFS symlinkdata attributes. |
|
NFS wcc attributes. |
|
NFS write reply. |
|
NFS write arguments. |
|
NTP control message as defined in RFC 1119 for mode=6 This record contains the fields used by the NTP protocol for control operations. |
|
NTP message as defined in RFC 5905. |
|
NTP mode 7 message. |
|
NTP standard message as defined in RFC 5905 for modes 1-5 This record contains the standard fields used by the NTP protocol for standard synchronization operations. |
|
Packet capture statistics. |
|
Record for Portable Executable (PE) section headers. |
|
Properties of an I/O packet source being read by Zeek. |
|
The definition of a “pcap interface”. |
|
The state of the compilation for a pcap filter. |
|
Enum type identifying dynamic BPF filters. |
|
Statistics about Zeek’s process. |
|
Name and flags for a single channel requested by the client. |
|
The list of channels requested by the client. |
|
The TS_UD_CS_CLUSTER data block is sent by the client to the server either to advertise that it can support the Server Redirection PDUs or to request a connection to a given session identifier. |
|
The TS_UD_CS_SEC data block contains security-related information used to advertise client cryptographic support. |
|
Holds statistics for all types of reassembly. |
|
Statistics about reporter messages and weirds. |
|
An SMB1 header. |
|
The response to an SMB2 close request, which is used by the client to close an instance of a file that was opened previously. |
|
Compression information as defined in SMB v. |
|
The request sent by the client to request either creation of or access to a file. |
|
The response to an SMB2 create_request request, which is sent by the client to request either creation of or access to a file. |
|
Encryption information as defined in SMB v. |
|
A series of boolean flags describing basic and extended file attributes for SMB2. |
|
This information class is used to query or set extended attribute (EA) information for a file. |
|
A vector of extended attribute (EA) information for a file. |
|
A series of integers flags used to set quota and content indexing control information for a file system volume in SMB2. |
|
An SMB2 globally unique identifier which identifies a file. |
|
An SMB2 header. |
|
The context type information as defined in SMB v. |
|
The response to an SMB2 negotiate request, which is used by the client to notify the server what dialects of the SMB2 protocol the client understands. |
|
Preauthentication information as defined in SMB v. |
|
A flags field that indicates additional information about the session that’s sent in the session_setup response. |
|
The request sent by the client to request a new authenticated session within a new or existing SMB 2 Protocol transport connection to the server. |
|
The response to an SMB2 session_setup request, which is sent by the client to request a new authenticated session within a new or existing SMB 2 Protocol transport connection to the server. |
|
An SMB2 transform header (for SMB 3.x dialects with encryption enabled). |
|
The response to an SMB2 tree_connect request, which is sent by the client to request access to a particular share on the server. |
|
MAC times for a file. |
|
The |
|
A |
|
A |
|
A generic SNMP header data structure that may include data from any version of SNMP. |
|
The top-level message data structure of an SNMPv1 datagram, not including the PDU data. |
|
The top-level message data structure of an SNMPv2 datagram, not including the PDU data. |
|
The top-level message data structure of an SNMPv3 datagram, not including the PDU data. |
|
A generic SNMP object value, that may include any of the
valid |
|
The |
|
A |
|
This record is for a SOCKS client or server to provide either a name or an address to represent a desired or established connection. |
|
The client and server each have some preferences for the algorithms used in each direction. |
|
This record lists the preferences of an SSH endpoint for algorithm selection. |
|
Fields of a SYN packet. |
|
A TCP Option field parsed from a TCP header. |
|
The full list of TCP Option fields parsed from a TCP header. |
|
Histograms returned by the |
|
Metrics returned by the |
|
Type that captures options used to create metrics. |
|
Statistics about threads. |
|
Statistics of timers. |
|
Records the identity of an encapsulating parent of a tunneled connection. |
|
Record type that is passed to |
|
Result of an X509 certificate chain verification |
|
A set of addresses. |
|
A vector of addresses. |
|
A vector of any, used by some builtin functions to store a list of varying types. |
|
A hook that is invoked when an assert statement fails. |
|
A hook that is invoked with the result of every assert statement. |
|
A table of BitTorrent “benc” values. |
|
BitTorrent “benc” value. |
|
A BitTorrent peer. |
|
A set of BitTorrent peers. |
|
Header table type used by BitTorrent analyzer. |
|
Meta-information about a parameter to a function/event. |
|
Vector type used to capture parameters of a function/event call. |
|
A connection’s identifying 4-tuple of endpoints and ports. |
|
A connection. |
|
A set of counts. |
|
The general part of a DNS reply. |
|
A Private RR type BINDS record. |
|
A DNSSEC DNSKEY record. |
|
A DNSSEC DS record. |
|
An additional DNS EDNS record. |
|
An DNS EDNS COOKIE (COOKIE) record. |
|
An DNS EDNS Client Subnet (ECS) record. |
|
An DNS EDNS TCP KEEPALIVE (TCP KEEPALIVE) record. |
|
A Private RR type LOC record. |
|
A DNS message. |
|
A DNSSEC NSEC3 record. |
|
A DNSSEC NSEC3PARAM record. |
|
A DNSSEC RRSIG record. |
|
A DNS SOA record. |
|
DNS SVCB and HTTPS RRs |
|
An additional DNS TSIG record. |
|
A vector of floating point numbers, used by telemetry builtin functions to store histogram bounds. |
|
Statistics about a |
|
Statistics about what a TCP endpoint sent. |
|
Computed entropy values. |
|
File Analysis handle for a file that Zeek is analyzing. |
|
File Analysis metadata that’s been inferred about a particular file. |
|
A set of file analyzer tags. |
|
The identifying 4-tuple of a uni-directional flow. |
|
Return type for from_json BIF. |
|
A parsed host/port combination describing server endpoint for an upcoming data transfer. |
|
GeoIP autonomous system information. |
|
GeoIP location information. |
|
A GTPv1 (GPRS Tunneling Protocol) header. |
|
HTTP message statistics. |
|
HTTP session statistics. |
|
Options extracted from ICMPv6 neighbor discovery messages as specified by RFC 4861. |
|
A type alias for a vector of ICMPv6 neighbor discovery message options. |
|
Values extracted from a Prefix Information option in an ICMPv6 neighbor discovery message as specified by RFC 4861. |
|
Packet context part of an ICMP message. |
|
Values extracted from an ICMP header. |
|
Specifics about an ICMP conversation/packet. |
|
Table type used to map script-level identifiers to meta-information describing them. |
|
A vector of counts, used by some builtin functions to store a list of indices. |
|
A vector of integers, used by telemetry builtin functions to store histogram bounds. |
|
A set of intervals. |
|
Values extracted from an IPv4 header. |
|
Values extracted from an IPv6 Authentication extension header. |
|
Values extracted from an IPv6 Destination options extension header. |
|
Values extracted from an IPv6 ESP extension header. |
|
A general container for a more specific IPv6 extension header. |
|
A type alias for a vector of IPv6 extension headers. |
|
Values extracted from an IPv6 Fragment extension header. |
|
Values extracted from an IPv6 header. |
|
Values extracted from an IPv6 Hop-by-Hop options extension header. |
|
Values extracted from an IPv6 Mobility Binding Acknowledgement message. |
|
Values extracted from an IPv6 Mobility Binding Error message. |
|
Values extracted from an IPv6 Mobility Binding Refresh Request message. |
|
Values extracted from an IPv6 Mobility Binding Update message. |
|
Values extracted from an IPv6 Mobility Care-of Test message. |
|
Values extracted from an IPv6 Mobility Care-of Test Init message. |
|
Values extracted from an IPv6 Mobility header. |
|
Values extracted from an IPv6 Mobility Home Test message. |
|
Values extracted from an IPv6 Mobility Home Test Init message. |
|
Values extracted from an IPv6 Mobility header’s message data. |
|
Values extracted from an IPv6 extension header’s (e.g. |
|
A type alias for a vector of IPv6 options. |
|
Values extracted from an IPv6 Routing extension header. |
|
IRC join information. |
|
Set of IRC join information. |
|
Values extracted from the layer 2 header. |
|
A list of MIME headers. |
|
A MIME header key/value pair. |
|
A structure indicating a MIME type and strength of a match against file magic signatures. |
|
A vector of file magic signature matches, ordered by strength of the signature, strongest first. |
|
Policy-level representation of a packet passed on by libpcap. |
|
A packet header, consisting of an IP header and transport-layer header. |
|
Output modes for packet profiling information. |
|
An RPC portmapper callit request. |
|
An RPC portmapper mapping. |
|
Table of RPC portmapper mappings. |
|
An RPC portmapper request. |
|
A raw packet header, consisting of L2 header and everything in
|
|
Meta-information about a record field. |
|
Table type used to map record field declarations to meta-information describing them. |
|
Meta-information about a script-level identifier. |
|
A vector of Signature and Hash Algorithms. |
|
Description of a signature match. |
|
A hook taking a fa_file, an any, and a string. |
|
A string-table of any. |
|
An ordered array of strings. |
|
Function mapping a string to a string. |
|
A set of strings. |
|
A vector of strings. |
|
A set of subnets. |
|
A vector of subnets. |
|
Helper type for return value of Smith-Waterman algorithm. |
|
Helper type for return value of Smith-Waterman algorithm. |
|
Parameters for the Smith-Waterman algorithm. |
|
Helper type for return value of Smith-Waterman algorithm. |
|
Return type for Smith-Waterman algorithm. |
|
A table of counts indexed by strings. |
|
A table of strings indexed by strings. |
|
Values extracted from a TCP header. |
|
A Teredo origin indication header. |
|
A Teredo packet header. |
|
A Teredo authentication header. |
|
A connection’s transport-layer protocol. |
|
Values extracted from a UDP header. |
|
Table type used to map variable names to their memory allocation. |
|
A vector of x509 opaques. |
Functions
Internal function. |
|
Internal function. |
|
Function for skipping packets based on their ICMP header. |
|
Function for skipping packets based on their IP header. |
|
Function for skipping packets based on their TCP header. |
|
Function for skipping packets based on their UDP header. |
|
The default JSON key mapper function. |
|
Returns maximum of two |
|
Returns maximum of two |
|
Returns maximum of two |
|
Returns minimum of two |
|
Returns minimum of two |
|
Returns minimum of two |
Detailed Interface
Runtime Options
- MQTT::max_payload_size
-
The maximum payload size to allocate for the purpose of payload information in
mqtt_publish
events (and the default MQTT logs generated from that).
- Weird::sampling_duration
-
How long a weird of a given type is allowed to keep state/counters in memory. For “net” weirds an expiration timer starts per weird name when first initializing its counter. For “flow” weirds an expiration timer starts once per src/dst IP pair for the first weird of any name. For “conn” weirds, counters and expiration timers are kept for the duration of the connection for each named weird and reset when necessary. E.g. if a “conn” weird by the name of “foo” is seen more than
Weird::sampling_threshold
times, then an expiration timer begins for “foo” and upon triggering will reset the counter for “foo” and unthrottle its rate-limiting until it once again exceeds the threshold.
- Weird::sampling_global_list
-
Rate-limits weird names in the table globally instead of per connection/flow.
- Weird::sampling_rate
-
The rate-limiting sampling rate. One out of every of this number of rate-limited weirds of a given type will be allowed to raise events for further script-layer handling. Setting the sampling rate to 0 will disable all output of rate-limited weirds.
- Weird::sampling_threshold
-
How many weirds of a given type to tolerate before sampling begins. I.e. this many consecutive weirds of a given type will be allowed to raise events for script-layer handling before being rate-limited.
- Weird::sampling_whitelist
-
Prevents rate-limiting sampling of any weirds named in the table.
- default_file_bof_buffer_size
- Type
- Attributes
- Default
4096
- Redefinition
from policy/frameworks/signatures/iso-9660.zeek
=
:2048 * (16 + 1)
Default amount of bytes that file analysis will buffer in order to use for mime type matching. File analyzers attached at the time of mime type matching or later, will receive a copy of this buffer.
- default_file_timeout_interval
-
Default amount of time a file can be inactive before the file analysis gives up and discards any internal state related to the file.
- ignore_checksums_nets
-
Checksums are ignored for all packets with a src address within this set of networks. Useful for cases where a host might be seeing packets collected from local hosts before checksums were applied by hardware. This frequently manifests when sniffing a local management interface on a host and Zeek sees packets before the hardware has had a chance to apply the checksums.
- udp_content_delivery_ports_use_resp
-
Whether ports given in
udp_content_delivery_ports_orig
andudp_content_delivery_ports_resp
are in terms of UDP packet’s destination port or the UDP connection’s “responder” port.
- udp_content_ports
-
Defines UDP ports (source or destination) for which the contents of either originator or responder streams should be delivered via
udp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_orig
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_orig
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,udp_contents
,udp_content_delivery_ports_use_resp
,udp_content_delivery_ports_resp
Redefinable Options
- BinPAC::flowbuffer_capacity_max
-
Maximum capacity, in bytes, that the BinPAC flowbuffer is allowed to grow to for use with incremental parsing of a given connection/analyzer.
- BinPAC::flowbuffer_capacity_min
-
The initial capacity, in bytes, that will be allocated to the BinPAC flowbuffer of a given connection/analyzer. If the buffer is later contracted, its capacity is also reduced to this size.
- BinPAC::flowbuffer_contract_threshold
-
The threshold, in bytes, at which the BinPAC flowbuffer of a given connection/analyzer will have its capacity contracted to
BinPAC::flowbuffer_capacity_min
after parsing a full unit. I.e. this is the maximum capacity to reserve in between the parsing of units. If, after parsing a unit, the flowbuffer capacity is greater than this value, it will be contracted.
- DCE_RPC::max_cmd_reassembly
-
The maximum number of simultaneous fragmented commands that the DCE_RPC analyzer will tolerate before the it will generate a weird and skip further input.
- DCE_RPC::max_frag_data
-
The maximum number of fragmented bytes that the DCE_RPC analyzer will tolerate on a command before the analyzer will generate a weird and skip further input.
- HTTP::upgrade_analyzers
- Type
table
[string
] ofAnalyzer::Tag
- Attributes
- Default
{}
- Redefinition
from base/protocols/websocket/main.zeek
+=
:websocket = Analyzer::ANALYZER_WEBSOCKET
Lookup table for Upgrade analyzers. First, a case sensitive lookup is done using the client’s Upgrade header. If no match is found, the all lower-case value is used. If there’s still no match Zeek uses dynamic protocol detection for the upgraded to protocol instead.
- KRB::keytab
-
Kerberos keytab file name. Used to decrypt tickets encountered on the wire.
- MIME::max_depth
-
Stop analysis of nested multipart MIME entities if this depth is reached. Setting this value to 0 removes the limit.
- NCP::max_frame_size
-
The maximum number of bytes to allocate when parsing NCP frames.
- NFS3::return_data
-
If true,
nfs_proc_read
andnfs_proc_write
events return the file data that has been read/written.See also:
NFS3::return_data_max
,NFS3::return_data_first_only
- NFS3::return_data_first_only
-
If
NFS3::return_data
is true, whether to only return data if the read or write offset is 0, i.e., only return data for the beginning of the file.
- NFS3::return_data_max
-
If
NFS3::return_data
is true, how much data should be returned at most.
- POP3::max_pending_commands
-
How many commands a POP3 client may have pending before Zeek forcefully removes the oldest.
Setting this value to 0 removes the limit.
- POP3::max_unknown_client_commands
-
How many invalid commands a POP3 client may use before Zeek starts raising analyzer violations.
Setting this value to 0 removes the limit.
- Pcap::bufsize
-
Number of Mbytes to provide as buffer space when capturing from live interfaces.
- Pcap::bufsize_offline_bytes
-
Number of bytes to use for buffering file read operations when reading from a PCAP file. Setting this to 0 uses operating system defaults as chosen by fopen().
- Pcap::non_fd_timeout
-
Default timeout for packet sources without file descriptors.
For libpcap based packet sources that do not provide a usable file descriptor for select(), the timeout provided to the IO loop is either zero if a packet was most recently available or else this value.
Depending on the expected packet rate per-worker and the amount of available packet buffer, raising this value can significantly reduce Zeek’s CPU usage at the cost of a small delay before processing packets. Setting this value too high may cause packet drops due to running out of available buffer space.
Increasing this value to 200usec on low-traffic Myricom based systems (5 kpps per Zeek worker) has shown a 50% reduction in CPU usage.
This is an advanced setting. Do monitor dropped packets and capture loss information when changing it.
Note
Packet sources that override
GetNextTimeout()
method may not respect this value.See also:
io_poll_interval_live
- Pcap::snaplen
-
Number of bytes per packet to capture from live interfaces.
- Reporter::errors_to_stderr
-
Tunable for sending reporter error messages to STDERR. The option to turn it off is presented here in case Zeek is being run by some external harness and shouldn’t output anything to the console.
- Reporter::info_to_stderr
-
Tunable for sending reporter info messages to STDERR. The option to turn it off is presented here in case Zeek is being run by some external harness and shouldn’t output anything to the console.
- Reporter::warnings_to_stderr
-
Tunable for sending reporter warning messages to STDERR. The option to turn it off is presented here in case Zeek is being run by some external harness and shouldn’t output anything to the console.
- SMB::max_dce_rpc_analyzers
-
Maximum number of DCE-RPC analyzers per connection before discarding them to avoid unbounded state growth.
See also:
smb_discarded_dce_rpc_analyzers
- SMB::max_pending_messages
-
The maximum number of messages for which to retain state about offsets, fids, or tree ids within the parser. When the limit is reached, internal parser state is discarded and
smb2_discarded_messages_state
raised.Setting this to zero will disable the functionality.
See also:
smb2_discarded_messages_state
- SMB::pipe_filenames
- Type
- Attributes
- Default
{}
- Redefinition
from base/protocols/smb/consts.zeek
=
:spoolss, winreg, samr, srvsvc, netdfs, lsarpc, wkssvc, MsFteWds
A set of file names used as named pipes over SMB. This only comes into play as a heuristic to identify named pipes when the drive mapping wasn’t seen by Zeek.
See also:
smb_pipe_connect_heuristic
- SSL::dtls_max_reported_version_errors
-
Maximum number of invalid version errors to report in one DTLS connection.
- SSL::dtls_max_version_errors
-
Number of non-DTLS frames that can occur in a DTLS connection before parsing of the connection is suspended. DTLS does not immediately stop parsing a connection because other protocols might be interleaved in the same UDP “connection”.
- SSL::max_alerts_per_record
-
Maximum number of Alert messages parsed from an SSL record with content_type alert (21). The remaining alerts are discarded. For TLS 1.3 connections, this is implicitly 1 as defined by RFC 8446.
- Telemetry::callback_timeout
-
Maximum amount of time for CivetWeb HTTP threads to wait for metric callbacks to complete on the IO loop.
- Telemetry::civetweb_threads
-
Number of CivetWeb threads to use.
- Threading::heartbeat_interval
-
The heartbeat interval used by the threading framework. Changing this should usually not be necessary and will break several tests.
- Tunnel::delay_gtp_confirmation
-
With this set, the GTP analyzer waits until the most-recent upflow and downflow packets are a valid GTPv1 encapsulation before issuing
analyzer_confirmation_info
. If it’s false, the first occurrence of a packet with valid GTPv1 encapsulation causes confirmation. Since the same inner connection can be carried differing outer upflow/downflow connections, setting to false may work better.
- Tunnel::delay_teredo_confirmation
-
With this set, the Teredo analyzer waits until it sees both sides of a connection using a valid Teredo encapsulation before issuing a
analyzer_confirmation_info
. If it’s false, the first occurrence of a packet with valid Teredo encapsulation causes a confirmation.
- Tunnel::ip_tunnel_timeout
-
How often to cleanup internal state for inactive IP tunnels (includes GRE tunnels).
- Tunnel::max_changes_per_connection
-
The number of tunnel_changed events that will be sent for a connection. Once this limit is hit, no more of those events will be sent to avoid a large number of events being sent for connections that regularly swap. This can be set to zero to disable this limiting.
- Tunnel::max_depth
-
The maximum depth of a tunnel to decapsulate until giving up. Setting this to zero will disable all types of tunnel decapsulation.
- Tunnel::validate_vxlan_checksums
-
Whether to validate the checksum supplied in the outer UDP header of a VXLAN encapsulation. The spec says the checksum should be transmitted as zero, but if not, then the decapsulating destination may choose whether to perform the validation.
- UnknownProtocol::first_bytes_count
-
The number of bytes to extract from the next header and log in the first bytes field.
- UnknownProtocol::sampling_duration
-
How long an analyzer/protocol pair is allowed to keep state/counters in in memory. Once the threshold has been hit, this is the amount of time before the rate-limiting for a pair expires and is reset.
- UnknownProtocol::sampling_rate
-
The rate-limiting sampling rate. One out of every of this number of rate-limited pairs of a given type will be allowed to raise events for further script-layer handling. Setting the sampling rate to 0 will disable all output of rate-limited pairs.
- UnknownProtocol::sampling_threshold
-
How many reports for an analyzer/protocol pair will be allowed to raise events before becoming rate-limited.
- WebSocket::payload_chunk_size
-
The WebSocket analyzer consumes and forwards frame payload in chunks to keep memory usage bounded. There should not be a reason to change this value except for debugging and testing reasons.
- WebSocket::use_dpd_default
-
Whether to enable DPD on WebSocket frame payload by default.
- WebSocket::use_spicy_analyzer
-
Whether to use the Spicy WebSocket protocol analyzer.
As of now, the BinPac version has better performance, but we may change the default in the future.
- allow_network_time_forward
-
Whether Zeek will forward network_time to the current time upon observing an idle packet source (or no configured packet source).
Only set this to F if you really know what you’re doing. Setting this to F on non-worker systems causes
network_time
to be stuck at 0.0 and timer expiration will be non-functional.The main purpose of this option is to yield control over network time to plugins or scripts via broker or other non-timer events.
See also:
network_time
,set_network_time
,packet_source_inactivity_timeout
- bits_per_uid
-
Number of bits in UIDs that are generated to identify connections and files. The larger the value, the more confidence in UID uniqueness. The maximum is currently 128 bits.
- check_for_unused_event_handlers
- Type
- Attributes
&redef
&deprecated
= “Remove in v7.1. This has been replaced by usage analyzer functionality.”- Default
F
If true, warns about unused event handlers at startup.
- cmd_line_bpf_filter
-
BPF filter the user has set via the -f command line options. Empty if none.
- detect_filtered_trace
-
Whether to attempt to automatically detect SYN/FIN/RST-filtered trace and not report missing segments for such connections. If this is enabled, then missing data at the end of connections may not be reported via
content_gap
.
- digest_salt
-
This salt value is used for several message digests in Zeek. We use a salt to help mitigate the possibility of an attacker manipulating source data to, e.g., mount complexity attacks or cause ID collisions. This salt is, for example, used by
get_file_handle
to generate installation-unique file IDs (the id field offa_file
).
- dns_session_timeout
-
Time to wait before timing out a DNS request.
- dpd_buffer_size
-
Size of per-connection buffer used for dynamic protocol detection. For each connection, Zeek buffers this initial amount of payload in memory so that complete protocol analysis can start even after the initial packets have already passed through (i.e., when a DPD signature matches only later). However, once the buffer is full, data is deleted and lost to analyzers that are activated afterwards. Then only analyzers that can deal with partial connections will be able to analyze the session.
See also:
dpd_reassemble_first_packets
,dpd_match_only_beginning
,dpd_ignore_ports
,dpd_max_packets
- dpd_ignore_ports
-
If true, don’t consider any ports for deciding which protocol analyzer to use.
See also:
dpd_reassemble_first_packets
,dpd_buffer_size
,dpd_match_only_beginning
- dpd_late_match_stop
- Type
- Attributes
- Default
F
- Redefinition
from policy/protocols/conn/speculative-service.zeek
=
:T
If true, stops signature matching after a late match. A late match may occur in case the DPD buffer is exhausted but a protocol signature matched. To allow late matching,
dpd_match_only_beginning
must be disabled.See also:
dpd_reassemble_first_packets
,dpd_buffer_size
,dpd_match_only_beginning
Note
Despite the name, this option stops all signature matching, not only signatures used for dynamic protocol detection but is triggered by DPD signatures only.
- dpd_match_only_beginning
- Type
- Attributes
- Default
T
- Redefinition
from policy/protocols/conn/speculative-service.zeek
=
:F
If true, stops signature matching if
dpd_buffer_size
has been reached.See also:
dpd_reassemble_first_packets
,dpd_buffer_size
,dpd_ignore_ports
Note
Despite the name, this option affects all signature matching, not only signatures used for dynamic protocol detection.
- dpd_max_packets
-
Maximum number of per-connection packets that will be buffered for dynamic protocol detection. For each connection, Zeek buffers up to this amount of packets in memory so that complete protocol analysis can start even after the initial packets have already passed through (i.e., when a DPD signature matches only later). However, once the buffer is full, data is deleted and lost to analyzers that are activated afterwards. Then only analyzers that can deal with partial connections will be able to analyze the session.
See also:
dpd_reassemble_first_packets
,dpd_match_only_beginning
,dpd_ignore_ports
,dpd_buffer_size
- dpd_reassemble_first_packets
-
Reassemble the beginning of all TCP connections before doing signature matching. Enabling this provides more accurate matching at the expense of CPU cycles.
See also:
dpd_buffer_size
,dpd_match_only_beginning
,dpd_ignore_ports
Note
Despite the name, this option affects all signature matching, not only signatures used for dynamic protocol detection.
- exit_only_after_terminate
-
Flag to prevent Zeek from exiting automatically when input is exhausted. Normally Zeek terminates when all packet sources have gone dry and communication isn’t enabled. If this flag is set, Zeek’s main loop will instead keep idling until
terminate
is explicitly called.This is mainly for testing purposes when termination behaviour needs to be controlled for reproducing results.
- expensive_profiling_multiple
- Type
- Attributes
- Default
0
- Redefinition
from policy/misc/profiling.zeek
=
:20
Multiples of
profiling_interval
at which (more expensive) memory profiling is done (0 disables).See also:
profiling_interval
,profiling_file
- frag_timeout
-
How long to hold onto fragments for possible reassembly. A value of 0.0 means “forever”, which resists evasion, but can lead to state accrual.
- global_hash_seed
-
Seed for hashes computed internally for probabilistic data structures. Using the same value here will make the hashes compatible between independent Zeek instances. If left unset, Zeek will use a temporary local seed.
- icmp_inactivity_timeout
-
If an ICMP flow is inactive, time it out after this interval. If 0 secs, then don’t time it out.
See also:
tcp_inactivity_timeout
,udp_inactivity_timeout
,set_inactivity_timeout
- ignore_checksums
-
If true, don’t verify checksums, and accept packets that give a length of zero in the IPv4 header. This is useful when running against traces of local traffic and the NIC checksum offloading feature is enabled. It can also be useful for running on altered trace files, and for saving a few cycles at the risk of analyzing invalid data. With this option, packets that have a value of zero in the total-length field of the IPv4 header are also accepted, and the capture-length is used instead. The total-length field is commonly set to zero when the NIC sequence offloading feature is enabled. Note that the
-C
command-line option overrides the setting of this variable.
- ignore_keep_alive_rexmit
-
Ignore certain TCP retransmissions for
conn_stats
. Some connections (e.g., SSH) retransmit the acknowledged last byte to keep the connection alive. If ignore_keep_alive_rexmit is set to true, such retransmissions will be excluded in the rexmit counter inconn_stats
.See also:
conn_stats
- io_poll_interval_default
-
How many rounds to go without checking IO sources with file descriptors for readiness by default. This is used when reading from traces.
Very roughly, when reading from a pcap, setting this to 100 results in 100 packets being processed without checking FD based IO sources.
Note
This should not be changed outside of development or when debugging problems with the main-loop, or developing features with tight main-loop interaction.
See also:
io_poll_interval_live
- io_poll_interval_live
-
How often to check IO sources with file descriptors for readiness when monitoring with a live packet source.
The poll interval gets defaulted to 100 which is good for cases like reading from pcap files and when there isn’t a packet source, but is a little too infrequent for live sources (especially fast live sources). Set it down a little bit for those sources.
Note
This should not be changed outside of development or when debugging problems with the main-loop, or developing features with tight main-loop interaction.
See also:
io_poll_interval_default
- likely_server_ports
- Type
- Attributes
- Default
{}
- Redefinition
from base/packet-protocols/ayiya/main.zeek
+=
:PacketAnalyzer::AYIYA::ayiya_ports
- Redefinition
from base/packet-protocols/geneve/main.zeek
+=
:PacketAnalyzer::Geneve::geneve_ports
- Redefinition
from base/packet-protocols/vxlan/main.zeek
+=
:PacketAnalyzer::VXLAN::vxlan_ports
- Redefinition
from base/packet-protocols/teredo/main.zeek
+=
:PacketAnalyzer::TEREDO::teredo_ports
- Redefinition
from base/packet-protocols/gtpv1/main.zeek
+=
:PacketAnalyzer::GTPV1::gtpv1_ports
- Redefinition
from base/protocols/dce-rpc/main.zeek
+=
:DCE_RPC::ports
- Redefinition
from base/protocols/dhcp/main.zeek
+=
:67/udp
- Redefinition
from base/protocols/dnp3/main.zeek
+=
:DNP3::ports
- Redefinition
from base/protocols/dns/main.zeek
+=
:DNS::ports
- Redefinition
from base/protocols/finger/main.zeek
+=
:Finger::ports
- Redefinition
from base/protocols/ftp/main.zeek
+=
:FTP::ports
- Redefinition
from base/protocols/ssl/main.zeek
+=
:SSL::ssl_ports, SSL::dtls_ports
- Redefinition
from base/protocols/http/main.zeek
+=
:HTTP::ports
- Redefinition
from base/protocols/imap/main.zeek
+=
:IMAP::ports
- Redefinition
from base/protocols/irc/main.zeek
+=
:IRC::ports
- Redefinition
from base/protocols/krb/main.zeek
+=
:KRB::tcp_ports, KRB::udp_ports
- Redefinition
from base/protocols/ldap/main.zeek
+=
:LDAP::ports_tcp, LDAP::ports_udp
- Redefinition
from base/protocols/modbus/main.zeek
+=
:Modbus::ports
- Redefinition
from base/protocols/mqtt/main.zeek
+=
:MQTT::ports
- Redefinition
from base/protocols/ntp/main.zeek
+=
:NTP::ports
- Redefinition
from base/protocols/radius/main.zeek
+=
:RADIUS::ports
- Redefinition
from base/protocols/rdp/main.zeek
+=
:RDP::rdp_ports, RDP::rdpeudp_ports
- Redefinition
from base/protocols/sip/main.zeek
+=
:SIP::ports
- Redefinition
from base/protocols/snmp/main.zeek
+=
:SNMP::ports
- Redefinition
from base/protocols/smb/main.zeek
+=
:SMB::ports
- Redefinition
from base/protocols/smtp/main.zeek
+=
:SMTP::ports
- Redefinition
from base/protocols/socks/main.zeek
+=
:SOCKS::ports
- Redefinition
from base/protocols/ssh/main.zeek
+=
:SSH::ports
- Redefinition
from base/protocols/syslog/main.zeek
+=
:Syslog::ports
- Redefinition
from base/protocols/xmpp/main.zeek
+=
:XMPP::ports
Ports which the core considers being likely used by servers. For ports in this set, it may heuristically decide to flip the direction of the connection if it misses the initial handshake.
- log_rotate_base_time
-
Base time of log rotations in 24-hour time format (
%H:%M
), e.g. “12:00”.
- max_analyzer_violations
-
The maximum number of analyzer violations the core generates before suppressing them for a given analyzer instance. A weird providing information about the analyzer and connection is generated once the limit is reached.
An analyzer generating this many violations is unlikely parsing the right protocol or potentially buggy.
See also
DPD::max_violations
which controls disabling analyzers through script logic after a certain number of violations was observed.
- max_find_all_string_length
-
Maximum string length allowed for calls to the
find_all
andfind_all_ordered
BIFs.
- max_timer_expires
-
The maximum number of expired timers to process after processing each new packet. The value trades off spreading out the timer expiration load with possibly having to hold state longer. A value of 0 means “process all expired timers with each new packet”.
- mmdb_asn_db
-
Default name of the MaxMind ASN database file:
- mmdb_city_db
-
Default name of the MaxMind City database file:
- mmdb_country_db
-
Default name of the MaxMind Country database file:
- mmdb_dir_fallbacks
- Type
- Attributes
- Default
["/usr/share/GeoIP", "/var/lib/GeoIP", "/usr/local/share/GeoIP", "/usr/local/var/GeoIP"]
Fallback locations for MaxMind databases. Zeek attempts these when
mmdb_dir
is not set, or it cannot read a DB file from it. For geolocation lookups, Zeek will first attempt to locate the city database in each of the fallback locations, and should this fail, attempt to locate the country one.
- mmdb_stale_check_interval
-
Sets the interval for MaxMind DB file staleness checks. When Zeek detects a change in inode or modification time, the database is re-opened. Setting a negative interval disables staleness checks.
- non_analyzed_lifetime
-
If a connection belongs to an application that we don’t analyze, time it out after this interval. If 0 secs, then don’t time it out (but
tcp_inactivity_timeout
,udp_inactivity_timeout
, andicmp_inactivity_timeout
still apply).
- packet_filter_default
-
Default mode for Zeek’s user-space dynamic packet filter. If true, packets that aren’t explicitly allowed through, are dropped from any further processing.
Note
This is not the BPF packet filter but an additional dynamic filter that Zeek optionally applies just before normal processing starts.
See also:
install_dst_addr_filter
,install_dst_net_filter
,install_src_addr_filter
,install_src_net_filter
,uninstall_dst_addr_filter
,uninstall_dst_net_filter
,uninstall_src_addr_filter
,uninstall_src_net_filter
- packet_source_inactivity_timeout
-
If a packet source does not yield packets for this amount of time, it is considered idle. When a packet source is found to be idle, Zeek will update network_time to current time in order for timer expiration to function. A packet source queueing up packets and not yielding them for longer than this interval without yielding any packets will provoke not-very-well-defined timer behavior.
On Zeek workers with low packet rates, timer expiration may be delayed by this many milliseconds after the last packet has been received.
- partial_connection_ok
-
If true, instantiate connection state when a partial connection (one missing its initial establishment negotiation) is seen.
- peer_description
-
Description transmitted to remote communication peers for identification.
- pkt_profile_freq
-
Frequency associated with packet profiling.
See also:
pkt_profile_modes
,pkt_profile_mode
,pkt_profile_file
- pkt_profile_mode
- Type
- Attributes
- Default
PKT_PROFILE_MODE_NONE
Output mode for packet profiling information.
See also:
pkt_profile_modes
,pkt_profile_freq
,pkt_profile_file
- profiling_interval
- Type
- Attributes
- Default
0 secs
- Redefinition
from policy/misc/profiling.zeek
=
:15.0 secs
Update interval for profiling (0 disables). The easiest way to activate profiling is loading policy/misc/profiling.zeek.
See also:
profiling_file
,expensive_profiling_multiple
- record_all_packets
-
If a trace file is given with
-w
, dump all packets seen by Zeek into it. By default, Zeek applies (very few) heuristics to reduce the volume. A side effect of setting this to true is that we can write the packets out before we actually process them, which can be helpful for debugging in case the analysis triggers a crash.See also:
trace_output_file
- report_gaps_for_partial
-
Whether we want
content_gap
for partial connections. A connection is partial if it is missing a full handshake. Note that gap reports for partial connections might not be reliable.See also:
content_gap
,partial_connection
- rpc_timeout
-
Time to wait before timing out an RPC request.
- running_under_test
-
Whether Zeek is being run under test. This can be used to alter functionality while testing, but should be used sparingly.
- sig_max_group_size
-
Maximum size of regular expression groups for signature matching.
- skip_http_data
-
Skip HTTP data for performance considerations. The skipped portion will not go through TCP reassembly.
See also:
http_entity_data
,skip_http_entity_data
,http_entity_data_delivery_size
- table_expire_delay
-
When expiring table entries, wait this amount of time before checking the next chunk of entries.
See also:
table_expire_interval
,table_incremental_step
- table_expire_interval
- Type
- Attributes
- Default
10.0 secs
- Redefinition
from policy/frameworks/management/agent/main.zeek
=
:2.0 secs
- Redefinition
from policy/frameworks/management/controller/main.zeek
=
:2.0 secs
Check for expired table entries after this amount of time.
See also:
table_incremental_step
,table_expire_delay
- table_incremental_step
-
When expiring/serializing table entries, don’t work on more than this many table entries at a time.
See also:
table_expire_interval
,table_expire_delay
- tcp_SYN_ack_ok
-
If true, instantiate connection state when a SYN/ACK is seen but not the initial SYN (even if
partial_connection_ok
is false).
- tcp_SYN_timeout
-
Check up on the result of an initial SYN after this much time.
- tcp_attempt_delay
-
Wait this long upon seeing an initial SYN before timing out the connection attempt.
- tcp_close_delay
-
Upon seeing a normal connection close, flush state after this much time.
- tcp_connection_linger
-
When checking a closed connection for further activity, consider it inactive if there hasn’t been any for this long. Complain if the connection is reused before this much time has elapsed.
- tcp_content_deliver_all_orig
-
If true, all TCP originator-side traffic is reported via
tcp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,tcp_contents
- tcp_content_deliver_all_resp
-
If true, all TCP responder-side traffic is reported via
tcp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_orig
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,tcp_contents
- tcp_content_delivery_ports_orig
-
Defines destination TCP ports for which the contents of the originator stream should be delivered via
tcp_contents
.See also:
tcp_content_delivery_ports_resp
,tcp_content_deliver_all_orig
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,tcp_contents
- tcp_content_delivery_ports_resp
-
Defines destination TCP ports for which the contents of the responder stream should be delivered via
tcp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_deliver_all_orig
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,tcp_contents
- tcp_excessive_data_without_further_acks
-
If we’ve seen this much data without any of it being acked, we give up on that connection to avoid memory exhaustion due to buffering all that stuff. If set to zero, then we don’t ever give up. Ideally, Zeek would track the current window on a connection and use it to infer that data has in fact gone too far, but for now we just make this quite beefy.
See also:
tcp_max_initial_window
,tcp_max_above_hole_without_any_acks
- tcp_inactivity_timeout
-
If a TCP connection is inactive, time it out after this interval. If 0 secs, then don’t time it out.
See also:
udp_inactivity_timeout
,icmp_inactivity_timeout
,set_inactivity_timeout
- tcp_match_undelivered
-
If true, pass any undelivered to the signature engine before flushing the state. If a connection state is removed, there may still be some data waiting in the reassembler.
- tcp_max_above_hole_without_any_acks
-
If we’re not seeing our peer’s ACKs, the maximum volume of data above a sequence hole that we’ll tolerate before assuming that there’s been a packet drop and we should give up on tracking a connection. If set to zero, then we don’t ever give up.
See also:
tcp_max_initial_window
,tcp_excessive_data_without_further_acks
- tcp_max_initial_window
-
Maximum amount of data that might plausibly be sent in an initial flight (prior to receiving any acks). Used to determine whether we must not be seeing our peer’s ACKs. Set to zero to turn off this determination.
See also:
tcp_max_above_hole_without_any_acks
,tcp_excessive_data_without_further_acks
- tcp_max_old_segments
-
Number of TCP segments to buffer beyond what’s been acknowledged already to detect retransmission inconsistencies. Zero disables any additional buffering.
- tcp_partial_close_delay
-
Generate a
connection_partial_close
event this much time after one half of a partial connection closes, assuming there has been no subsequent activity.
- tcp_reassembler_ports_orig
-
For services without a handler, these sets define originator-side ports that still trigger reassembly.
See also:
tcp_reassembler_ports_resp
- tcp_reassembler_ports_resp
-
For services without a handler, these sets define responder-side ports that still trigger reassembly.
See also:
tcp_reassembler_ports_orig
- tcp_reset_delay
-
Upon seeing a RST, flush state after this much time.
- tcp_session_timer
-
After a connection has closed, wait this long for further activity before checking whether to time out its state.
- tcp_storm_interarrival_thresh
-
FINs/RSTs must come with this much time or less between them to be considered a “storm”.
See also:
tcp_storm_thresh
- tcp_storm_thresh
-
Number of FINs/RSTs in a row that constitute a “storm”. Storms are reported as
weird
via the notice framework, and they must also come within intervals of at mosttcp_storm_interarrival_thresh
.See also:
tcp_storm_interarrival_thresh
- time_machine_profiling
- Type
- Attributes
&redef
&deprecated
="Remove in v7.1. Unused."
- Default
F
If true, output profiling for Time-Machine queries.
- truncate_http_URI
-
Maximum length of HTTP URIs passed to events. Longer ones will be truncated to prevent over-long URIs (usually sent by worms) from slowing down event processing. A value of -1 means “do not truncate”.
See also:
http_request
- udp_content_deliver_all_orig
-
If true, all UDP originator-side traffic is reported via
udp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_resp
tcp_content_delivery_ports_orig
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_resp
,udp_contents
,udp_content_delivery_ports_use_resp
- udp_content_deliver_all_resp
-
If true, all UDP responder-side traffic is reported via
udp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_resp
tcp_content_delivery_ports_orig
,udp_content_delivery_ports_orig
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_contents
,udp_content_delivery_ports_use_resp
- udp_content_delivery_ports_orig
-
Defines UDP destination ports for which the contents of the originator stream should be delivered via
udp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_orig
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_resp
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,udp_contents
,udp_content_delivery_ports_use_resp
,udp_content_ports
- udp_content_delivery_ports_resp
-
Defines UDP destination ports for which the contents of the responder stream should be delivered via
udp_contents
.See also:
tcp_content_delivery_ports_orig
,tcp_content_delivery_ports_resp
,tcp_content_deliver_all_orig
,tcp_content_deliver_all_resp
,udp_content_delivery_ports_orig
,udp_content_deliver_all_orig
,udp_content_deliver_all_resp
,udp_contents
,udp_content_delivery_ports_use_resp
,udp_content_ports
- udp_inactivity_timeout
-
If a UDP flow is inactive, time it out after this interval. If 0 secs, then don’t time it out.
See also:
tcp_inactivity_timeout
,icmp_inactivity_timeout
,set_inactivity_timeout
- use_conn_size_analyzer
-
Whether to use the
ConnSize
analyzer to count the number of packets and IP-level bytes transferred by each endpoint. If true, these values are returned in the connection’sendpoint
record value.
- watchdog_interval
-
Zeek’s watchdog interval.
Constants
- CONTENTS_BOTH
- Type
- Default
3
Record both originator and responder contents.
- CONTENTS_NONE
- Type
- Default
0
Turn off recording of contents.
- CONTENTS_ORIG
- Type
- Default
1
Record originator contents.
- CONTENTS_RESP
- Type
- Default
2
Record responder contents.
- ENDIAN_BIG
- Type
- Default
2
Big endian.
- ENDIAN_CONFUSED
- Type
- Default
3
Tried to determine endian, but failed.
- ENDIAN_LITTLE
- Type
- Default
1
Little endian.
- ENDIAN_UNKNOWN
- Type
- Default
0
Endian not yet determined.
- ICMP_UNREACH_ADMIN_PROHIB
- Type
- Default
13
Administratively prohibited.
- ICMP_UNREACH_HOST
- Type
- Default
1
Host unreachable.
- ICMP_UNREACH_NEEDFRAG
- Type
- Default
4
Fragment needed.
- ICMP_UNREACH_NET
- Type
- Default
0
Network unreachable.
- ICMP_UNREACH_PORT
- Type
- Default
3
Port unreachable.
- ICMP_UNREACH_PROTOCOL
- Type
- Default
2
Protocol unreachable.
- IPPROTO_AH
- Type
- Default
51
IPv6 authentication header.
- IPPROTO_DSTOPTS
- Type
- Default
60
IPv6 destination options header.
- IPPROTO_ESP
- Type
- Default
50
IPv6 encapsulating security payload header.
- IPPROTO_FRAGMENT
- Type
- Default
44
IPv6 fragment header.
- IPPROTO_HOPOPTS
- Type
- Default
0
IPv6 hop-by-hop-options header.
- IPPROTO_ICMP
- Type
- Default
1
Control message protocol.