Skip to content

Commit afbaf0f

Browse files
committed
Unirec output: update conversion map (add reverse fields, fix invalid PPI type)
1 parent 950fcfa commit afbaf0f

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

extra_plugins/output/unirec/config/unirec-elements.txt

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ TIME_FIRST time e0id150,e0id152,e0id154,e0id156 # T
3535
TIME_LAST time e0id151,e0id153,e0id155,e0id157 # Time of the last packet of a flow
3636
DIR_BIT_FIELD uint8 _internal_dbf_ # Bit field used for determining incoming/outgoing flow (1 => Incoming, 0 => Outgoing)
3737
LINK_BIT_FIELD uint64 _internal_lbf_ # Bit field of links on which was flow seen
38+
SRC_MAC macaddr e0id56
39+
DST_MAC macaddr e0id80
40+
41+
# --- Additional biflow fields ---
42+
BYTES_REV uint64 e29305id1
43+
PACKETS_REV uint32 e29305id2
44+
TCP_FLAGS_REV uint8 e29305id6
3845

3946
# --- DNS specific fields ---
4047
DNS_ANSWERS uint16 e8057id0 # DNS answers
@@ -156,6 +163,6 @@ PPI_TLS_REC_LENGTHS int16* e0id291/e8057id1010 # basi
156163
PPI_TLS_REC_TIMES uint16* e0id291/e8057id1011 # basicList of TLS record timestamps
157164
PPI_TLS_CONTENT_TYPES uint8* e0id291/e8057id1012 # basicList of TLS record content types
158165
PPI_PKT_LENGTHS int16* e0id291/e8057id1013 # basicList of packet lengths
159-
PPI_PKT_TIMES uint16* e0id291/e8057id1014 # basicList of packet timestamps
166+
PPI_PKT_TIMES time* e0id291/e8057id1014 # basicList of packet timestamps
160167
PPI_PKT_FLAGS int8* e0id291/e8057id1015 # basicList of packet TCP flags
161168
PPI_PKT_DIRECTIONS int8* e0id291/e8057id1016 # basicList of packet directions

0 commit comments

Comments
 (0)