Eldon Koyle

sessions for non-analyzed protocols should still be tracked with a conn entry

20

Zeek's current behavior of silently ignoring traffic for which there is no analyzer is quite unexpected to new users. The assumption is that the conn log should contain data similar...

add conn entries for all tunnels and differentiate from non-tunnel conns

4

Currently, many tunnel types do not create conn entries. I believe the root of this issue is #3915 and if that behavior is resolved, this issue would be mostly resolved....