main.zeek

PacketAnalyzer

Namespace:: PacketAnalyzer
Imports:: base/frameworks/analyzer/main.zeek

Summary

Functions

`PacketAnalyzer::register_for_port`: `function`	Registers an individual well-known port for an analyzer.
`PacketAnalyzer::register_for_ports`: `function`	Registers a set of well-known ports for an analyzer.

Detailed Interface

Functions

PacketAnalyzer::register_for_port 

Type:: function (parent: PacketAnalyzer::Tag, child: PacketAnalyzer::Tag, p: port) : bool

Registers an individual well-known port for an analyzer. If a future connection on this port is seen, the analyzer will be automatically assigned to parsing it. The function adds to all ports already registered, it doesn’t replace them.

Parameters:

tag – The tag of the analyzer.
p – The well-known port to associate with the analyzer.

Returns:

True if the port was successfully registered.

PacketAnalyzer::register_for_ports 

Type:: function (parent: PacketAnalyzer::Tag, child: PacketAnalyzer::Tag, server_ports: set [port], non_server_ports: set [port] &default = { } &optional) : bool

Registers a set of well-known ports for an analyzer. If a future connection on one of these ports is seen, the analyzer will be automatically assigned to parsing it. The function adds to all ports already registered, it doesn’t replace them.

Parameters:

parent – The parent packet analyzer tag.
child – The child packet analyzer tag.
server_ports – The set of well-known server ports to associate with the analyzer. These ports will automatically be added to likely_server_ports.
non_server_ports – The set of well-known non-server ports (e.g., client ports) to associate with the analyzer. These ports will not be added to likely_server_ports.

Returns:

True if the ports were successfully registered.