Re: [Zeek-Dev] connection $history - 'g' for gap

2019-04-08 Thread Jim Mellander
It might be valuable to have some (optional) way of accessing the byte counts consisting the content gap(s). If the content gap is somewhere in a long tail, but DPD still fails, then the explanation could be something other than a content gap. On the other hand, maybe you're just thinking about

[Zeek-Dev] connection $history - 'g' for gap

2019-04-08 Thread Vern Paxson
I'm finding it would be handy to be able to glance at a connection log line and know that the analysis for the connection experienced a content gap. For example, this can immediately explain why DPD failed to identify a known server. Proposal: add 'g'/'G' connection history values, scaled in the