Analyzer_confirmation_info for packet analyzer

[biswa61]

Hi,
can you tell me how to use analyzer_confirmation_info for packet analyzer?
As stated in document,
“For packet analyzers, a confirmation is only raised if there’s a session (connection) associated with a given packet. Confirmations are raised only once per session. Tunnel protocols like VXLAN or Geneve are examples for this behavior.”
So, what is the standard procedure to use this event for packet analyzer as I can’t able to get confirmation event for each connection detected similar to protocol analyzer!
Thanks
Biswa

[awelzel]

@biswa61

So, what is the standard procedure to use this event for packet analyzer as I can’t able to get confirmation event for each connection detected similar to protocol analyzer!

Can you provide some background? Are you writing your own packet analyzer or do you have difficulties with getting the confirmation for VXLAN or GENEVE?

[Benjamin_Bannier]

I strongly suspect this is just a spin-off of the existing thread

Zeek event to get connection info when application is detected

Hi, can you tell me how to use analyzer_confirmation_info for packet analyzer? As stated in document, “For packet analyzers, a confirmation is only raised if there’s a session (connection) associated with a given packet. Confirmations are raised only once per session. Tunnel protocols like VXLAN or Geneve are examples for this behavior.” So, what is the standard procedure to use this event for packet analyzer as I can’t able to get confirmation event similar to protocol analyzer! Thanks Bi…

[Benjamin_Bannier]

@biswa61, I have closed and unlisted this new topic, please continue the discussion in the original thread.