URG Flag

Zeek
1

Hello,

I would like to know how I can retrieve urg flag in the tcp segment or count the number of tcp packets with a URG flag in a connection ?

thanks

2

One way is through event tcp_packet:

event tcp_packet(c: connection, is_orig: bool, flags: string, seq: count, ack: count, len: count, payload: string)
  {
  if ( strstr(flags, "U") > 0 )
    {
    ...
    }
  }

But please note that it requires a per-TCP-packet event and thus only works for low volume traffic.

Ruoming