I-Zeek 3.0.0 yokuhlaziya i-traffic ikhishwe

Eminyakeni eyisikhombisa emva kokwakhiwa kwegatsha lokugcina elibalulekile kwethulwe ukukhululwa kokuhlaziywa kwethrafikhi kanye nesistimu yokutholwa kokungena kwenethiwekhi I-Zeek 3.0.0 , eyasakazwa ngaphambili ngaphansi kwegama elithi Bro. Lokhu ukukhishwa kokuqala okubalulekile kusukela lapho ukuqamba kabusha iphrojekthi, uzibophezele ngenxa yokuthi igama elithi Bro lalihlotshaniswa ne-subculture encane yegama elifanayo, futhi hhayi njengento ehlosiwe ethi "Big Brother" evela kunoveli kaGeorge Orwell ethi "1984" ehloswe ababhali. Ikhodi yesistimu ibhalwe ku-C++ futhi isatshalaliswa ngu ngaphansi kwelayisensi ye-BSD.

I-Zeek iyinkundla yezibalo zethrafikhi egxile kakhulu, kodwa ingagcini nje, ekuqapheni umcimbi wokuphepha. Amamojula ahlinzekwe ukuze kuhlaziywe futhi kuhlulwe izivumelwano zenethiwekhi ezisezingeni lohlelo lokusebenza, kucatshangelwa isimo sokuxhumaniseka nokuvumela ukudalwa kwelogi enemininingwane (ingobo yomlando) yomsebenzi wenethiwekhi. Ulimi oluqondene ngqo nesizinda luyaphakanyiswa ukuze kubhalwe imibhalo yokuqapha kanye nokuhlonza okudidayo, kucatshangelwa imininingwane ethile yengqalasizinda ethile. Uhlelo lwenzelwe ukusetshenziswa kumanethiwekhi anomkhawulokudonsa ophezulu. I-API ihlinzekelwe ukuze ihlanganiswe nezinhlelo zolwazi zezinkampani zangaphandle kanye nokushintshisana kwedatha ngesikhathi sangempela.

В udaba olusha:

  • I-analyzer yephrothokholi ye-NTP ibhalwe kabusha ngokuphelele futhi isihlaziyi esisha se-MQTT sengeziwe. Amakhono abahlaziyi be-DNS, i-RDP, i-SMB ne-TLS anwetshiwe. Ku-DNS, ukucozululwa kwamarekhodi e-SPF kunikezwa, kanye ne-DNSSEC - RRSIG, DNSKEY, DS, NSEC kanye ne-NSEC3 kanye nokukhethwa kwemicimbi ehambisana nawo. Ukwesekwa okwengeziwe kwephrothokholi ye-SMB 3.x kusihlaziyi se-SMB, nokusekelwa kwe-TLS 1.3 ye-TLS;
  • Ukwesekwa kokususwa kwe-deencapsulation kwemifudlana esakazwa ngaphakathi kwamathaneli e-VXLAN sekuqalisiwe;
  • Ukwesekwa okwengeziwe kwezixhumanisi ezinohlobo lwe-NFLOG;
  • Kwengezwe ikhono lokulondoloza idatha ekhishiwe kulogi ekubhalweni ngekhodi kwe-UTF8;
  • Ukusekelwa kokuvalwa kwemisebenzi engaziwa kwengeziwe olimini lokubhala, u-opharetha wokubala amathebula ngefomethi yenani elingukhiye (“for ( key, value in t)”) yengeziwe, imisebenzi yokuhlukanisa i-vector yesitayela sePython yenziwe. (“v[2:4]”), isakhiwo esisha, i-paraglob, sihlongozwa ukuze kuhlanganiswe ngokushesha imaski yezintambo kumasethi amakhulu kanambambili wedatha;
  • Zonke izinkomba zegama elithi "bro" ezindleleni zamafayela, izilungiselelo, amaphakheji, imibhalo, izikhala zamagama nemisebenzi zithathelwe indawo u-"zeek" (ukusekelwa kwamagama amadala agcinwe ukuze ahambelane emuva). Umphathi wephakheji we-bro-pkg uqanjwe kabusha waba yi-zkg.

Source: opennet.ru

Engeza amazwana