6 Commits

Author SHA1 Message Date
Toni
42c54d3755 Initial tunnel decoding (GRE - Layer4 only atm) (#55)
Initial tunnel decoding (GRE - Layer4 only atm). Fixes #53
 * make finally use of the thread distribution seed
 * Handle GRE/PPP subprotocol the right way
 * Add `-t` command line / config option
 * Removed duplicated and obsolete IP{4,6}_SIZE_SMALLER_THAN_HEADER which is the same as IP{4,6}_PACKET_TOO_SHORT
 * Updated error event schema

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-02-25 15:17:16 +01:00
Toni Uhlig
7b2cd268bf Updated JSON schema files and a test to make use of the UUID feature.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-10-29 15:25:19 +01:00
Toni Uhlig
99accd03a2 Moved datalink json key/value from error to packet events and renamed it to pkt_datalink.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2023-04-21 16:48:40 +02:00
Toni Uhlig
49352698a0 nDPId: Added error event threshold to prevent event spamming which may be abused.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-10-17 06:36:30 +02:00
Toni Uhlig
d4633c1192 New flow event: 'analysis'.
* The goal was to provide a separate event for extracted feature that are not required
   and only useful for a few (e.g. someone who wants do ML).
 * Increased network buffer size to 32kB (8192 * 4).
 * Switched timestamp precision from ms to us for *ALL* timestamps.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-09-13 22:05:08 +02:00
Toni Uhlig
daaaa61519 Renamed basic event to error event for the sake of the logic.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-03-13 03:08:44 +01:00