Logging of first packet's source IP.

first_pkt_src.bro

# Adds first packet's source IP to conn.log.

redef record connection += {
	first_pkt_src: addr &optional;
};

redef record Conn::Info += {
	## Source address of the first packet.
	first_pkt_src: addr &optional &log;
};

event new_connection(c: connection)
	{
	local hdr: raw_pkt_hdr = get_current_packet_header();
	if ( hdr?$ip )
		c$first_pkt_src = hdr$ip$src;
	else if (hdr?$ip6 )
		c$first_pkt_src = hdr$ip6$src;
	}

event connection_state_remove(c: connection)
	{
	if ( c?$first_pkt_src )
		c$conn$first_pkt_src = c$first_pkt_src;
	}