Giter Club home page Giter Club logo

netbase's People

Contributors

pmphry avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

netbase's Issues

Issue when using "netbase" Framework with Zeek 4

Hi!
First I'll thank a lot for this project, which I need it to use in Zeek 4
but when I put this framework in the following directory, I have got the error below:

zeek -C -r /home/mohammad/Downloads/mypackets.trace /opt/zeek/share/zeek/base/frameworks/netbase-master/main.bro

error in /opt/zeek/share/zeek/base/frameworks/netbase-master/main.bro, line 112: &default is not valid for global variables except for tables (&default=set())

can you help me please to solve this issue?
Thank a lot :)

use_conn_size_analyzer and size or orig/resp_bytes is not accurate for PCR

Hello,

Great project. I would like to communicate a known issue with using orig$bytes/resp$bytes or the use_conn_size_analyzer for tracking tx/rx. The issue is that for TCP these use sequence numbers to calculate the metric. For long or large connections the TCP seq can wrap which will lead to unreliable results:

From https://docs.zeek.org/en/current/scripts/base/protocols/conn/main.zeek.html

orig_bytes: count&log&optional
The number of payload bytes the originator sent. For TCP this is taken from sequence numbers and might be inaccurate (e.g., due to large connections).

resp_bytes: count&log&optional
The number of payload bytes the responder sent. See orig_bytes.

In my and others testing this has been confirmed to cause ridiculously large flow tx/rx reports. Instead it is recommended to use orig/resp_ip_bytes which utilize the len header of the ip frame.

orig_ip_bytes: count&log&optional
Number of IP level bytes that the originator sent (as seen on the wire, taken from the IP total_length header field). Only set if use_conn_size_analyzer = T.

Using the *_ip_bytes field on our sensors to calculate PCR and comparing that to the PCR calculated on firewall logs reported tx/rx bytes counts has confirmed accuracy for myself.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.