Merge pull request #177 from piercema/main

Fix #TODO: add config for packet count
FoxIO-LLC · Oct 24, 2024 · d9fb2cc · d9fb2cc
2 parents a74ec2b + 52c3734
commit d9fb2cc
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/zeek/ja4ssh/main.zeek b/zeek/ja4ssh/main.zeek
@@ -25,6 +25,8 @@ export {
 
   };
 
+  option ja4_ssh_packet_count = 200;
+
   # Logging boilerplate
   redef enum Log::ID += { LOG };
   global log_fingerprint_ja4ssh: event(rec: Info);
@@ -122,8 +124,7 @@ event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count,
           c$fp$ja4ssh$resp_pack_len += rp$tcp$dl;
         }
     }
-    # TODO:  add config for packet count
-    if(|c$fp$ja4ssh$orig_pack_len| + |c$fp$ja4ssh$resp_pack_len| >= 200) {
+    if(|c$fp$ja4ssh$orig_pack_len| + |c$fp$ja4ssh$resp_pack_len| >= ja4_ssh_packet_count) {
       do_ja4ssh(c);
     }
 }
@@ -147,4 +148,4 @@ event connection_state_remove(c: connection) {
   if(c?$fp && c$fp?$ja4ssh && c$fp$ja4ssh$is_ssh) {
     do_ja4ssh(c);
   }
-}
+}