# The code for "weird" logging activity.
**URL:** https://community.zeek.org/t/the-code-for-weird-logging-activity/5063
**Category:** Zeek
**Created:** [October 16, 2017, 7:58pm UTC](https://community.zeek.org/t/the-code-for-weird-logging-activity/5063 "2017-10-16T19:58:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [October 16, 2017, 7:58pm UTC](https://community.zeek.org/t/the-code-for-weird-logging-activity/5063/1 "2017-10-16T19:58:43Z")
Hey All,
So, I was going through the weird.log file generated by bro every hour,
and found lot of activity that I would like to suppress, and for some
activity I would like to know the source (i.e. what part of bro code is raising those
“weird” activity logs in the weird.log) to analyse whether it’s legit or can be suppressed.
For example, I would like to suppress “DNS\_RR\_unknown\_type 46”, as it’s ,
I think, is not an unknown-type, it’s defined in RFC 4034 as “RRSIG” (and some other similar weird activity.)
Hence, wanted to see what code during packet analysis might have raised one of the \*\_weird events to log that connection.
I was searching for the string “weird” in an effort to find the Bro scripts
that either load weird or create a log stream in weird.log, but couldn’t find the code/script
that is responsible for those notices in weird.log
P.S: I know about the weird.bro in notice framework, I am searching for part of the code that would **use** \*\_weird events to log weird activity in weird.log.
Checked policy/base dirs :
policy]$ find . -type f -exec cat {} + | grep “weird”
##! This script handles core generated connection related “weird” events to
##! push weird information about connections into the weird framework.
# This is weird beause it would mean that someone didn’t
event conn\_weird(“smb\_pipe\_request\_missing\_uuid”, c, “”);
# This is weird: the inquirer must also be providing answers in
Any pointers to the right direction would be really appreciated 🙂
Thanks,
Fatema.
---
### Author:  [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)
#### Post date: [October 16, 2017, 8:01pm UTC](https://community.zeek.org/t/the-code-for-weird-logging-activity/5063/2 "2017-10-16T20:01:44Z")
Ah.. it's also 'Weird' inside of analyzers, so 'weird' would not have found it:
$ git grep DNS\_RR\_unknown\_type
CHANGES: \* DNS: Log the type number for the DNS\_RR\_unknown\_type weird. (Vlad Grigorescu)
scripts/base/frameworks/notice/weird.bro: ["DNS\_RR\_unknown\_type"] = ACTION\_LOG,
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_unknown\_type", fmt("%d", msg-\>atype));
testing/btest/Baseline/scripts.base.protocols.dns.duplicate-reponses/weird.log:1363716396.798286 CHhAvVGS1DHFjwGM9 55.247.223.174 27285 222.195.43.124 53 DNS\_RR\_unknown\_type 46 F bro
$ git grep 'analyzer-\>Weird'
src/analyzer/protocol/dnp3/DNP3.cc: analyzer-\>Weird("dnp3\_header\_lacks\_magic");
src/analyzer/protocol/dnp3/DNP3.cc: analyzer-\>Weird("dnp3\_unexpected\_flow\_direction");
src/analyzer/protocol/dnp3/DNP3.cc: analyzer-\>Weird("dnp3\_negative\_or\_zero\_length\_link\_layer");
src/analyzer/protocol/dnp3/DNP3.cc: analyzer-\>Weird("dnp3\_first\_application\_layer\_chunk\_missing");
src/analyzer/protocol/dnp3/DNP3.cc: analyzer-\>Weird(fmt("dnp3\_corrupt\_%s\_checksum", where));
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_truncated\_len\_lt\_hdr\_len");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_Conn\_count\_too\_large");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_truncated\_quest\_too\_short");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_truncated\_ans\_too\_short");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_truncated\_RR\_rdlength\_lt\_len");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_unknown\_type", fmt("%d", msg-\>atype));
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_NAME\_too\_long");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_label\_forward\_compress\_offset");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_label\_len\_gt\_pkt");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_label\_too\_long");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_label\_len\_gt\_name\_len");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_length\_mismatch");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_length\_mismatch");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_length\_mismatch");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_length\_mismatch");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_RR\_bad\_length");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_AAAA\_neg\_length");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_A6\_neg\_length");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_TXT\_char\_str\_past\_rdlen");
src/analyzer/protocol/dns/DNS.cc: analyzer-\>Weird("DNS\_CAA\_char\_str\_past\_rdlen");
src/analyzer/protocol/http/HTTP.cc: analyzer-\>Weird(msg);
src/analyzer/protocol/http/HTTP.cc: analyzer-\>Weird("illegal\_%\_at\_end\_of\_URI");
src/analyzer/protocol/http/HTTP.cc: analyzer-\>Weird("partial\_escape\_at\_end\_of\_URI");
src/analyzer/protocol/http/HTTP.cc: analyzer-\>Weird("double\_%\_in\_URI");
src/analyzer/protocol/http/HTTP.cc: analyzer-\>Weird("unescaped\_%\_in\_URI");
src/analyzer/protocol/ncp/NCP.cc: analyzer-\>Weird(e.msg().c\_str());
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird(fmt("unknown\_netbios\_type: 0x%x", type));
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird(fmt("excess\_netbios\_hdr\_len (%d \> %d)",
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("deficit\_netbios\_hdr\_len");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird(fmt("excess\_netbios\_hdr\_len (%d \> %d)",
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird(fmt("deficit\_netbios\_hdr\_len (%d \< %d)",
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("netbios\_raw\_session\_msg");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("no\_smb\_session\_using\_parsesambamsg");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("netbios\_server\_session\_request");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("netbios\_client\_session\_reply");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("netbios\_client\_session\_reply");
src/analyzer/protocol/netbios/NetbiosSSN.cc: analyzer-\>Weird("netbios\_client\_session\_reply");
src/analyzer/protocol/rpc/RPC.cc: analyzer-\>Weird(msg);
src/analyzer/protocol/tcp/TCP\_Reassembler.cc: tcp\_analyzer-\>Weird("above\_hole\_data\_without\_any\_acks");
src/analyzer/protocol/tcp/TCP\_Reassembler.cc: tcp\_analyzer-\>Weird("excessive\_data\_without\_further\_acks");
src/analyzer/protocol/teredo/Teredo.h: { analyzer-\>Weird(name); }
$
---
### Author:  [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [October 16, 2017, 8:11pm UTC](https://community.zeek.org/t/the-code-for-weird-logging-activity/5063/3 "2017-10-16T20:11:38Z")
Hah, there’s a reason we have -i option with grep _facepalm_ 🙂 (could have saved me lot of time).
Thanks Justin for the quick response. Appreciate it!
Yay!
Fatema.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/the-code-for-weird-logging-activity/5063/4 "2022-05-06T15:45:21Z")