Hi,
I tried to write simple script to detect long running connection using
zeek (3.0) threshold. I set duration in connection established event and
then using duration_threshold_crossed logged connection above the limit.
But Notice log is then flooded with every new established connection.
Simple PoC bellow. Did I missed something? Is there any better way to
detect long running connection? I tried Corelight bro-long-connections
but there is lot overhead in my environment. Thanks for pointing me the
right way!
Hi Petr,
Your example code looked correct to me, but I found what simply looked
like a bug in the connection thresholding code that did the duration
comparison in reverse of what it should. Here's my proposed patch:
https://github.com/zeek/zeek/pull/899
- Jon
Hi Jon,
thanks for the fix. Works like a charm!