<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta content="text/html; charset=utf-8">
</head>
<body>
That could get very messy in the real world. How about start of first gap, length of first gap, total number of gaps?<br>
<br>
<br>
Sent with BlackBerry Work<br>
(www.blackberry.com)<br>
<br>
<div class="gw_quote" style="border-top:#b5c4df 1pt solid; padding-top:6px; font-size:14px">
<div><b>From: </b><span>anthony kasza <<a href="mailto:anthony.kasza@gmail.com">anthony.kasza@gmail.com</a>></span></div>
<div><b>Date: </b><span>Wednesday, Apr 10, 2019, 12:18 AM</span></div>
<div><b>To: </b><span>Jim Mellander <<a href="mailto:jmellander@lbl.gov">jmellander@lbl.gov</a>></span></div>
<div><b>Cc: </b><span>zeek-dev@zeek.org <<a href="mailto:zeek-dev@zeek.org">zeek-dev@zeek.org</a>>, Vern Paxson <<a href="mailto:vern@corelight.com">vern@corelight.com</a>></span></div>
<div><b>Subject: </b><span>[EXT] Re: [Zeek-Dev] connection $history - 'g' for gap</span></div>
</div>
<br>
<div>
<div dir="auto">I like the idea of logging gap ranges for a connection. Could a vector be used to store gap start and gap stop offsets?
<div dir="auto"><br>
</div>
<div dir="auto">-AK</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 9, 2019, 11:01 Jim Mellander <<a href="mailto:jmellander@lbl.gov">jmellander@lbl.gov</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Thanks. I was thinking of something a bit different - the total amount of the content gap is useful, but in some cases it might be useful to know where the content gaps occurred, whether
in the head of the connection, which likely is impactful for protocol analysis, or in a long tail, where it probably doesn't affect analysis.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Perhaps some tunable setting indicating that "I only care about content gaps in the first 10K (or whatever) of the connection" could address that...<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Apr 9, 2019 at 9:36 AM Justin Azoff <<a href="mailto:justin@corelight.com" target="_blank" rel="noreferrer">justin@corelight.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Mon, Apr 8, 2019 at 8:13 PM Jim Mellander <<a href="mailto:jmellander@lbl.gov" target="_blank" rel="noreferrer">jmellander@lbl.gov</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif">It might be valuable to have some (optional) way of accessing the byte counts consisting the content gap(s). If the content gap is somewhere in a long tail, but DPD still fails, then the explanation could
be something other than a content gap.</div>
<div style="font-family:arial,helvetica,sans-serif"><br>
</div>
<div style="font-family:arial,helvetica,sans-serif">On the other hand, maybe you're just thinking about content gaps at the head of a connection before it has been fully analyzed.<br>
</div>
</div>
</blockquote>
</div>
<div><br>
</div>
This is the missed_bytes field:
<div><br>
</div>
<div>
<div>missed_bytes: count &log &default = 0 &optional</div>
<div>Indicates the number of bytes missed in content gaps, which is representative of packet loss. A value other than zero will normally cause protocol analysis to fail but some analysis may have been completed prior to the packet loss.</div>
<div><br>
</div>
-- <br>
<div dir="ltr" class="m_6277106771508150375gmail-m_1612098723188045722gmail_signature">
<div dir="ltr">Justin</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
_______________________________________________<br>
zeek-dev mailing list<br>
<a href="mailto:zeek-dev@zeek.org" target="_blank" rel="noreferrer">zeek-dev@zeek.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek-dev" rel="noreferrer noreferrer" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek-dev</a><br>
</blockquote>
</div>
</div>
</body>
</html>