# smb\_mapping log add new field from conn.log

**URL:** <https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088>\
**Category:** Zeek\
**Created:** [November 3, 2017, 9:57am UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088 "2017-11-03T09:57:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [November 3, 2017, 9:57am UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/1 "2017-11-03T09:57:08Z")

</div>

Hi,

i need to copy a field from conn.log and add it in smb\_mapping.log, in my script copy part is working but its not writing in to smb\_mapping log , i am using correct smb events ? or anything wrong there?

my code

@load policy/protocols/smb  
module TrackSMB;

redef LogAscii::use\_json = T;

export {

global conn\_resp\_ip\_bytes: table[addr] of count &synchronized &write\_expire=7day;

global conn\_name\_proto: table[addr] of transport\_proto &synchronized &write\_expire=7day;

redef record SMB::TreeInfo += {  
proto: transport\_proto &optional &log;  
resp\_ip\_bytes: count &optional &log;

};  
}

if(rec?$resp\_ip\_bytes) {

conn\_resp\_ip\_bytes[rec$id$orig\_h] = rec$resp\_ip\_bytes;

}

if(rec?$proto) {  
conn\_name\_proto[rec$id$orig\_h] = rec$proto;  
}

}

event file\_over\_new\_connection(f:fa\_file; c: connection, is\_orig: bool) &priority=10  
{

if ( c$id$orig\_h in TrackSMB::conn\_resp\_ip\_bytes )  
f$info$resp\_ip\_bytes = TrackSMB::conn\_resp\_ip\_bytes[c$id$orig\_h];

if ( c$id$resp\_h in TrackSMB::conn\_resp\_ip\_bytes )  
f$info$resp\_ip\_bytes = TrackSMB::conn\_resp\_ip\_bytes[c$id$resp\_h];

if ( c$id$orig\_h in TrackSMB::conn\_name\_proto )  
c$smb$proto = TrackSMB::conn\_name\_proto[c$id$orig\_h];  
if ( c$id$resp\_h in TrackSMB::conn\_name\_proto )  
f$info$proto = TrackSMB::conn\_name\_proto[c$id$resp\_h];

}  
anything wrong in above script or need to change any events ?

Regards,  
Sunu

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [November 3, 2017, 9:59am UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/2 "2017-11-03T09:59:12Z")

</div>

Hi,

i need to copy a field from conn.log and add it in smb\_mapping.log, in my script copy part is working but its not writing in to smb\_mapping log , i am using correct smb events ? or anything wrong there?

my code

@load policy/protocols/smb  
module TrackSMB;

redef LogAscii::use\_json = T;

export {

global conn\_resp\_ip\_bytes: table[addr] of count &synchronized &write\_expire=7day;

global conn\_name\_proto: table[addr] of transport\_proto &synchronized &write\_expire=7day;

redef record SMB::TreeInfo += {  
proto: transport\_proto &optional &log;  
resp\_ip\_bytes: count &optional &log;

};  
}

event Conn::log\_conn (rec: Conn::Info)

{

if(rec?$resp\_ip\_bytes) {

conn\_resp\_ip\_bytes[rec$id$orig\_h] = rec$resp\_ip\_bytes;

}

if(rec?$proto) {  
conn\_name\_proto[rec$id$orig\_h] = rec$proto;  
}

}

event file\_over\_new\_connection(f:fa\_file; c: connection, is\_orig: bool) &priority=10  
{

if ( c$id$orig\_h in TrackSMB::conn\_resp\_ip\_bytes )  
f$info$resp\_ip\_bytes = TrackSMB::conn\_resp\_ip\_bytes[c$id$orig\_h];

if ( c$id$resp\_h in TrackSMB::conn\_resp\_ip\_bytes )  
f$info$resp\_ip\_bytes = TrackSMB::conn\_resp\_ip\_bytes[c$id$resp\_h];

if ( c$id$orig\_h in TrackSMB::conn\_name\_proto )  
c$smb$proto = TrackSMB::conn\_name\_proto[c$id$orig\_h];  
if ( c$id$resp\_h in TrackSMB::conn\_name\_proto )  
f$info$proto = TrackSMB::conn\_name\_proto[c$id$resp\_h];

}  
anything wrong in above script or need to change any events ?

Regards,  
Sunu

---

<div class="post-metadata">

**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\
**Post date:** [November 3, 2017, 12:09pm UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/3 "2017-11-03T12:09:04Z")

</div>

You have several problems that I'm seeing but I haven't actually your script to see if there are more.

> &nbsp;&nbsp;&nbsp;redef record SMB::TreeInfo += {  
> &nbsp;&nbsp;&nbsp;&nbsp;proto: transport\_proto &optional &log;  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;resp\_ip\_bytes: count &optional &log;  
> };

You added these fields to the SMB::TreeInfo record (just keep that in mind)...

> event Conn::log\_conn (rec: Conn::Info)  
> {  
> if(rec?$resp\_ip\_bytes) {  
> conn\_resp\_ip\_bytes[rec$id$orig\_h] = rec$resp\_ip\_bytes;  
> }
> 
> if(rec?$proto) {  
> conn\_name\_proto[rec$id$orig\_h] = rec$proto;  
> }

This whole section is only run when a conn log entry is being written so if everything only happens over a single connection you won't see your tables have any data since nothing will be written until the connection ends.

> event file\_over\_new\_connection(f:fa\_file; c: connection, is\_orig: bool)  
> &priority=10  
> {  
> if ( c$id$orig\_h in TrackSMB::conn\_resp\_ip\_bytes )  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;f$info$resp\_ip\_bytes = TrackSMB::conn\_resp\_ip\_bytes[c$id$orig\_h];

You put those fields into the SMB::TreeInfo record, but f$info is the Files::Info record.

> &nbsp;&nbsp;&nbsp;&nbsp;c$smb$proto = TrackSMB::conn\_name\_proto[c$id$orig\_h];  
> &nbsp;&nbsp;&nbsp;&nbsp;if ( c$id$resp\_h in TrackSMB::conn\_name\_proto )  
> &nbsp;&nbsp;&nbsp;&nbsp;f$info$proto = TrackSMB::conn\_name\_proto[c$id$resp\_h];

You are jumping around a bit here, you added the proto field to SMB::TreeInfo, but c$smb doesn't even exist. To access the SMB::TreeInfo record, it should be c$smb\_state$current\_tree

&nbsp;&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\
**Post date:** [November 3, 2017, 1:07pm UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/4 "2017-11-03T13:07:42Z")

</div>

Keep in mind that if you are running a cluster, your global values are stored locally on each worker so connections happening on different workers won’t know the values for the other workers.

.Seth

---

<div class="post-metadata">

**Author:** ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)\
**Post date:** [November 3, 2017, 1:11pm UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/5 "2017-11-03T13:11:21Z")

</div>

Hi Sunu,

Seth have pretty much addressed all the problems the script has.  
Just wanted to add, that be careful in the types of events you choose  
to log entries for.

event “file\_over\_new\_connection” will be triggered for “every” file Bro sees  
over a connection.  
And event “log\_conn” will be triggered for every connection Bro logs record for.

what your code is trying to do currently, is recording protocol and resp\_ip\_bytes for every connection,  
and if the connection happens to have a file transfer, then, logging those two fields in “file” record,  
which doesn’t seem to be your use case.

Also, I do not see any checks for “SMB” protocol specifically. Hence, your all the if conditions will always  
be true, if the connection happen to have resp\_ip\_bytes and proto, which majority of Bro connections would have.

Thanks,  
Fatema.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/smb-mapping-log-add-new-field-from-conn-log/5088/6 "2022-05-06T15:45:23Z")

</div>