Extract IP Header Options

Justin Mullins <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAFY8Zi=HcRG5NMPtX1HKRw_AhitFdMGxVC42YK2CfbeJ6QqA5g@mail.gmail.com>
Hi,

I was wondering is there an existing way in Zeek to log IP Header Options?
The conn log has a lot of the IP Header fields but not the IP Header
"Options" field data. Specifically looking at logging data related to CIPSO
packet labeling (reference:
https://tools.ietf.org/html/draft-ietf-cipso-ipsecurity-01).

If not, can anyone point me to a decent example of a bro script logging
similar data from the IP Header? (it's been quite a few years since I've
looked at bro scripts and I haven't found any examples doing something
similar to what I want)

Thank guys any information you can provide would be helpful!

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.