zeek-long-connections icon indicating copy to clipboard operation
zeek-long-connections copied to clipboard

No conn_long entries for idle connections

Open awelzel opened this issue 1 year ago • 0 comments

When configuring this package with:

redef LongConnections::default_durations=LongConnection::Durations(5sec);
redef LongConnection::repeat_last_duration = T;

Initial expectation was that a hanging nc -4 localhost 8080 to a nc -l -p 8080 would produce a conn_long entries 5 seconds after connection establishment, repeating every 5 seconds in conn_long until Zeek times out the connection due to inactivity.

However, because there's no packets for the connection flowing, it's c$duration field is not updated and so there's not a single conn_long entry created for it, just one conn.log entry with "duration":0.00007796287536621094".

Wonder if the callback should compute "an assumed duration" of the connection at the time of the callback instead of relying on c$duration that may be stale, or whether that's just a corner-case that doesn't matter.

local duration = network_time() - c$start_time;

awelzel avatar Jun 05 '23 15:06 awelzel