Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Logging of first packet's source IP.
# Adds first packet's source IP to conn.log.
redef record connection += {
first_pkt_src: addr &optional;
};
redef record Conn::Info += {
## Source address of the first packet.
first_pkt_src: addr &optional &log;
};
event new_connection(c: connection)
{
local hdr: raw_pkt_hdr = get_current_packet_header();
if ( hdr?$ip )
c$first_pkt_src = hdr$ip$src;
else if (hdr?$ip6 )
c$first_pkt_src = hdr$ip6$src;
}
event connection_state_remove(c: connection)
{
if ( c?$first_pkt_src )
c$conn$first_pkt_src = c$first_pkt_src;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.