heartbleed.zeek

Detect the TLS heartbleed attack. See http://heartbleed.com for more.

Summary

`Notice::Type`: `enum`	`Heartbleed::SSL_Heartbeat_Attack`: Indicates that a host performed a heartbleed attack or scan. `Heartbleed::SSL_Heartbeat_Attack_Success`: Indicates that a host performing a heartbleed attack was probably successful. `Heartbleed::SSL_Heartbeat_Many_Requests`: Indicates we saw many heartbeat requests without a reply. `Heartbleed::SSL_Heartbeat_Odd_Length`: Indicates we saw heartbeat requests with odd length.
`SSL::Info`: `record`	New Fields `SSL::Info` last_originator_heartbeat_request_size: `count` `&optional` last_responder_heartbeat_request_size: `count` `&optional` originator_heartbeats: `count` `&default` = `0` `&optional` responder_heartbeats: `count` `&default` = `0` `&optional` heartbleed_detected: `bool` `&default` = `F` `&optional` enc_appdata_packages: `count` `&default` = `0` `&optional` enc_appdata_bytes: `count` `&default` = `0` `&optional`
`SSL::disable_analyzer_after_detection`: `bool` `&redef`