Actions
Bug #2217
closedevent_type flow is missing icmpv4 (while it has icmpv6) info wherever available
Affected Versions:
Effort:
Difficulty:
Label:
Description
Originally reported on SELKS user list by Brandon.
This would exist for IPv6-ICMP but not for IPv4-ICMP
{
"timestamp": "2017-09-26T00:43:30.001064+0200",
"flow_id": 1140273124741010,
"event_type": "flow",
"src_ip": "2001:xxxxxxx",
"dest_ip": "2a02:0xxxxxx",
"proto": "IPv6-ICMP",
"icmp_type": 1,
"icmp_code": 0,
"flow": {
"pkts_toserver": 1,
"pkts_toclient": 0,
"bytes_toserver": 138,
"bytes_toclient": 0,
"start": "2017-09-26T00:43:24.331666+0200",
"end": "2017-09-26T00:43:24.331666+0200",
"age": 0,
"state": "new",
"reason": "timeout",
"alerted": false
}
}
Actions