Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow creating an analyzer which can consume both TCP and UDP traffic #3359

Open
bbannier opened this issue Jul 5, 2021 · 0 comments
Open

Comments

@bbannier
Copy link
Member

bbannier commented Jul 5, 2021

Currently a protocol analyzer needs to be declared to analyze either TCP or UDP traffic, and it is e.g., not possible to declare a Spicy analyzer which can analyze both TCP or UDP.

This restriction can be worked around by declaring two separate analyzers which share the same grammar, but analyze different traffic. The analyzers might even produce identical data and only differ artificially in name (e.g., OpenVPN_TCP and OpenVPN_UDP in zeek/spicy-analyzers); these names also appear in user-visible Zeek logs.

We should consider extending the EVT glue layer so protocol analyzers can be declared which could analyze both TCP and UDP.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant