size file

Zeek
1

hi,

I have this code:

event connection_established(c: connection) {

local orig_file = generate_extraction_filename(extrac_prefix, c, “orig.dat”);
local orig_f = open(orig_file);
set_contents_file(c$id, CONTENTS_ORIG, orig_f);

local resp_file = generate_extraction_filename(extrac_prefix, c, “resp.dat”);
local resp_f = open(resp_file);
set_contents_file(c$id, CONTENTS_RESP, resp_f);

}

and I would like set a maximum size, I think that I have two options,

  1. set a maximum size file
  2. control the data so that it does not exceed the size

How can I do this?

thanks

2

Hi Rober,

I think sadly the answer in this case is that this will require
modifications to the Bro core. As far as I can see, set_contents_file is
an irreversible operation (if Bro started extracting the content of a
connection you cannot stop it anymore).

Johanna