Re: tcp partial connections

On Thu, Nov 28, 2019 at 7:06 AM Palumbo Mauro <[email protected]> wrote:

>         if ( TCP() && TCP()->IsPartial() )
>                 return;
>
> This is true for example for the HTTP, SSH, SSL analyzers and more. My understanding is that this is to prevent app layer analyzers or scripts relying on them from breaking down or missing some information when processing packets with possible missing bytes.

Mre related to the "breaking down" part: current protocol parsers
don't have any type of "re-synchronization" mechanism so particularly
if we miss the TCP handshake and assume we may be starting in the
middle of the app-layer protocol stream (or else have a content gap),
the parser won't know what to do with the incoming data and so the
IsPartial() checks just exit early, before attempting to parse
further.

> How much reliable is this check TCP()->IsPartial()  for partial tcp sessions in the tcp analyzer?

Should be reliable in detecting the problematic scenario AFAIK, but in
the case where just the TCP handshake packets are missing and not any
segment data, analyzers that exit early like that are skipping streams
they actually should be able to parse.

- Jon

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek