Re: [Zeek-Dev] Hi + LL Analyzer

2019-02-27 Thread Robin Sommer
On Wed, Feb 27, 2019 at 16:07 +0100, Jan Grashöfer wrote: > At first glance it looks like IP-layer multiplexing is done in > NetSessions::{NextPacket, DoNextPacket} and the Transport-layer is tackled > in Manager::BuildInitialAnalyzerTree in context of initializing a > connection. Well,

Re: [Zeek-Dev] Hi + LL Analyzer

2019-02-27 Thread Jan Grashöfer
On 26/02/2019 02:36, Robin Sommer wrote: > I see three pieces here overall that I think can be tackled > independently: > > (1) Link-layer: Currently hardcoded in Packet::ProcessLayer2() > > (2) IP-Layer: Currently hardcoded in NetSessions::NextPacket() > > (3) Transport-layer: Currently