base/protocols/irc/main.zeek

IRC

Implements the core IRC analysis support. The logging model is to log IRC commands along with the associated response and some additional metadata about the connection if it’s available.

Namespace:: IRC

Summary

Types

IRC::Info: record

Redefinitions

`Log::ID`: `enum`	`IRC::LOG`
`connection`: `record`	New Fields: `connection` irc: `IRC::Info` `&optional` IRC session information.
`likely_server_ports`: `set` `&redef`

Events

IRC::irc_log: event

Event that can be handled to access the IRC record as it is sent on to the logging framework.

Hooks

IRC::log_policy: Log::PolicyHook

Detailed Interface

Types

IRC::Info 

Type:

Fields:

ts: time &log: Timestamp when the command was seen.

uid: string &log: Unique ID for the connection.

id: conn_id &log: The connection’s 4-tuple of endpoint addresses/ports.

nick: string &log &optional: Nickname given for the connection.

user: string &log &optional: Username given for the connection.

command: string &log &optional: Command given by the client.

value: string &log &optional: Value for the command given by the client.

addl: string &log &optional: Any additional data for the command.

dcc_file_name: string &log &optional

(present if base/protocols/irc/dcc-send.zeek is loaded)

DCC filename requested.

dcc_file_size: count &log &optional

(present if base/protocols/irc/dcc-send.zeek is loaded)

Size of the DCC transfer as indicated by the sender.

dcc_mime_type: string &log &optional

(present if base/protocols/irc/dcc-send.zeek is loaded)

Sniffed mime type of the file.

fuid: string &log &optional

(present if base/protocols/irc/files.zeek is loaded)

File unique ID.

Events

IRC::irc_log 

Type:: event (rec: IRC::Info)

Event that can be handled to access the IRC record as it is sent on to the logging framework.

Hooks

IRC::log_policy 

Type:: Log::PolicyHook