Re: Absolute ack and seq number of tcp packet
Jon Siwek <[email protected]> Mon, 2 Dec 2019 10:26:56 -0800
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAMzgZ0JjQi1_CmWU3+yQwMZCo=8mRNhfqhz2TbDA2NQJQzJ4tw@mail.gmail.com> |
On Thu, Nov 28, 2019 at 11:38 AM Hui Lin (Hugo) <[email protected]> wrote: > In the tcp_packet event, how can I obtain the absolute values (found in the tcp header), not the relative values of ack and seq numbers. The `get_current_packet_header()` BIF likely works for you: https://docs.zeek.org/en/stable/scripts/base/bif/zeek.bif.zeek.html#id-get_current_packet_header Or else the `raw_packet` event is also something that uses the `raw_pkt_hdr` type which should have the absolute sequence numbers. - Jon _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek