trace-summary
trace-summary copied to clipboard
Fixed parsing of `unknown_transport` lines in the conn.log
Now the following error goes away:
Ignoring corrupt line: 1761814048.127874 CmMFVmcRZAnzkCv0a 137.164.23.36 0 224.0.0.1 0 unknown_transport - - -
- OTH F T 0 - 1 36 0 0 - 2 worker-11
and instead you see additional section as follows:
>== Unknown Transport Connections Summary by Source/Destination IPs
Source IP | Destination IP | Count
----------------------------------------------------------------------------------------------------
131.243.244.219 | 224.0.0.1 | 11.0
128.3.40.3 | 224.0.0.1 | 10.0
128.3.3.2 | 224.0.0.1 | 10.0
Hey @initconf - thanks! It seems your changes were done to an older trace-summary revision than we have in the repo. There were some updates done for linting and formatting, sorry. Could you see if you could forward port your updates to the latest revision? Seems totally reasonable to have a summary for the unknown transports.
Superseded by https://github.com/zeek/trace-summary/pull/15