Skip to content

Fixed parsing of unknown_transport lines in the conn.log#14

Closed
initconf wants to merge 1 commit into
zeek:masterfrom
initconf:fixed-unknown-protocol-parsing-error
Closed

Fixed parsing of unknown_transport lines in the conn.log#14
initconf wants to merge 1 commit into
zeek:masterfrom
initconf:fixed-unknown-protocol-parsing-error

Conversation

@initconf

@initconf initconf commented Nov 1, 2025

Copy link
Copy Markdown

Now the following error goes away:

Ignoring corrupt line: 1761814048.127874        CmMFVmcRZAnzkCv0a       137.164.23.36   0       224.0.0.1       0       unknown_transport       -       -       -
-       OTH     F       T       0       -       1       36      0       0       -       2       worker-11

and instead you see additional section as follows:

>== Unknown Transport Connections Summary by Source/Destination IPs

Source IP                                | Destination IP                           | Count
----------------------------------------------------------------------------------------------------
131.243.244.219                          | 224.0.0.1                                |  11.0
128.3.40.3                               | 224.0.0.1                                |  10.0
128.3.3.2                                | 224.0.0.1                                |  10.0

Now the following error goes away:

Ignoring corrupt line: 1761814048.127874        CmMFVmcRZAnzkCv0a       137.164.23.36   0       224.0.0.1       0       unknown_transport       -       -       -
-       OTH     F       T       0       -       1       36      0       0       -       2       worker-11

and instead you see additional section as follows:

>== Unknown Transport Connections Summary by Source/Destination IPs

Source IP                                | Destination IP                           | Count
----------------------------------------------------------------------------------------------------
131.243.244.219                          | 224.0.0.1                                |  11.0
128.3.40.3                               | 224.0.0.1                                |  10.0
128.3.3.2                                | 224.0.0.1                                |  10.0
@awelzel

awelzel commented Nov 4, 2025

Copy link
Copy Markdown

Hey @initconf - thanks! It seems your changes were done to an older trace-summary revision than we have in the repo. There were some updates done for linting and formatting, sorry. Could you see if you could forward port your updates to the latest revision? Seems totally reasonable to have a summary for the unknown transports.

@timwoj

timwoj commented Nov 7, 2025

Copy link
Copy Markdown
Member

Superseded by #15

@timwoj timwoj closed this Nov 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants