]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
flow-log: log TCP flags per direction
authorVictor Julien <victor@inliniac.net>
Wed, 21 May 2014 13:37:10 +0000 (15:37 +0200)
committerVictor Julien <victor@inliniac.net>
Mon, 28 Jul 2014 13:47:45 +0000 (15:47 +0200)
In addition to flags for the entire session, also log out TCP flags
for both directions separately.

src/output-json-flow.c

index 3579bb5e76004ed1740bffbf1015365c6e0f7bb2..685010ef1dbf5c946f8b528538fe74e33d5cedf5 100644 (file)
@@ -221,12 +221,19 @@ static void JsonFlowLogJSON(JsonFlowLogThread *aft, json_t *js, Flow *f)
 
         TcpSession *ssn = f->protoctx;
 
-        char hexflags[3] = "00";
-        if (ssn)
-            snprintf(hexflags, sizeof(hexflags), "%02x",
-                    ssn->tcp_packet_flags);
+        char hexflags[3] = "";
+        snprintf(hexflags, sizeof(hexflags), "%02x",
+                ssn ? ssn->tcp_packet_flags : 0);
         json_object_set_new(tjs, "tcp_flags", json_string(hexflags));
 
+        snprintf(hexflags, sizeof(hexflags), "%02x",
+                ssn ? ssn->client.tcp_flags : 0);
+        json_object_set_new(tjs, "tcp_flags_ts", json_string(hexflags));
+
+        snprintf(hexflags, sizeof(hexflags), "%02x",
+                ssn ? ssn->server.tcp_flags : 0);
+        json_object_set_new(tjs, "tcp_flags_tc", json_string(hexflags));
+
         json_object_set_new(js, "tcp", tjs);
     }
 }