zeek-long-connections
zeek-long-connections copied to clipboard
corelight
Zeek package for tracking long connections to report them before they have completed.
When configuring this package with: ``` redef LongConnections::default_durations=LongConnection::Durations(5sec); redef LongConnection::repeat_last_duration = T; ``` Initial expectation was that a hanging `nc -4 localhost 8080` to a `nc -l -p 8080` would...
I sometimes see exact duplicate log entries for a connection in conn_long.log. I've seen this in Zeek 6.01 and 6.2. A detailed discussion is on Slack https://zeekorg.slack.com/archives/CSZBXF6TH/p1714741043670259. For example, below...
