policy/protocols/ssl/heartbleed.zeek

Heartbleed

Detect the TLS heartbleed attack. See http://heartbleed.com for more.

Namespace

Heartbleed

Imports

base/frameworks/notice, base/protocols/ssl

Summary

Redefinitions

Notice::Type: enum	Heartbleed::SSL_Heartbeat_Attack: Indicates that a host performed a heartbleed attack or scan. Heartbleed::SSL_Heartbeat_Attack_Success: Indicates that a host performing a heartbleed attack was probably successful. Heartbleed::SSL_Heartbeat_Many_Requests: Indicates we saw many heartbeat requests without a reply. Heartbleed::SSL_Heartbeat_Odd_Length: Indicates we saw heartbeat requests with odd length.
SSL::Info: record	New Fields SSL::Info last_originator_heartbeat_request_size: count &optional last_responder_heartbeat_request_size: count &optional originator_heartbeats: count &default = 0 &optional responder_heartbeats: count &default = 0 &optional heartbleed_detected: bool &default = F &optional enc_appdata_packages: count &default = 0 &optional enc_appdata_bytes: count &default = 0 &optional
SSL::disable_analyzer_after_detection: bool &redef

Detailed Interface