- ICMP not in conn.log

Zeek
1

Hi all,

Anyone knows why ICMP does not appear in conn.log ?

I see that the plugin and icmp analyzer are loaded, yet no indication in conn.log for proto icmp.

Thanks

B

2

We never created a model to include that data. I've had it on my radar for a while, but unfortunately have not found the time to add it.

I was hoping to figure out a way to include the data in conn.log for connections where ICMP was seen in relation to a connection (like Time Exceeded) instead of just having them listed as separate "connections".

   .Seth