diff --git a/zeek/ja4ssh/main.zeek b/zeek/ja4ssh/main.zeek index 18635cc..7eada49 100644 --- a/zeek/ja4ssh/main.zeek +++ b/zeek/ja4ssh/main.zeek @@ -25,6 +25,8 @@ export { }; + option ja4_ssh_packet_count = 200; + # Logging boilerplate redef enum Log::ID += { LOG }; global log_fingerprint_ja4ssh: event(rec: Info); @@ -122,8 +124,7 @@ event ConnThreshold::packets_threshold_crossed(c: connection, threshold: count, c$fp$ja4ssh$resp_pack_len += rp$tcp$dl; } } - # TODO: add config for packet count - if(|c$fp$ja4ssh$orig_pack_len| + |c$fp$ja4ssh$resp_pack_len| >= 200) { + if(|c$fp$ja4ssh$orig_pack_len| + |c$fp$ja4ssh$resp_pack_len| >= ja4_ssh_packet_count) { do_ja4ssh(c); } } @@ -147,4 +148,4 @@ event connection_state_remove(c: connection) { if(c?$fp && c$fp?$ja4ssh && c$fp$ja4ssh$is_ssh) { do_ja4ssh(c); } -} \ No newline at end of file +}