:tocdepth: 3

base/init-bare.zeek
===================
.. zeek:namespace:: AF_Packet
.. zeek:namespace:: Analyzer
.. zeek:namespace:: BinPAC
.. zeek:namespace:: Cluster
.. zeek:namespace:: ConnKey
.. zeek:namespace:: ConnThreshold
.. zeek:namespace:: DCE_RPC
.. zeek:namespace:: DHCP
.. zeek:namespace:: EventMetadata
.. zeek:namespace:: FTP
.. zeek:namespace:: Finger
.. zeek:namespace:: GLOBAL
.. zeek:namespace:: Gnutella
.. zeek:namespace:: HTTP
.. zeek:namespace:: IP
.. zeek:namespace:: JSON
.. zeek:namespace:: KRB
.. zeek:namespace:: Log
.. zeek:namespace:: MIME
.. zeek:namespace:: MOUNT3
.. zeek:namespace:: MQTT
.. zeek:namespace:: NCP
.. zeek:namespace:: NFS3
.. zeek:namespace:: NTLM
.. zeek:namespace:: NTP
.. zeek:namespace:: PE
.. zeek:namespace:: POP3
.. zeek:namespace:: Pcap
.. zeek:namespace:: RADIUS
.. zeek:namespace:: RDP
.. zeek:namespace:: Reporter
.. zeek:namespace:: SMB
.. zeek:namespace:: SMB1
.. zeek:namespace:: SMB2
.. zeek:namespace:: SMTP
.. zeek:namespace:: SNMP
.. zeek:namespace:: SOCKS
.. zeek:namespace:: SSH
.. zeek:namespace:: SSL
.. zeek:namespace:: Storage
.. zeek:namespace:: TCP
.. zeek:namespace:: Telemetry
.. zeek:namespace:: Threading
.. zeek:namespace:: Tunnel
.. zeek:namespace:: UnknownProtocol
.. zeek:namespace:: WebSocket
.. zeek:namespace:: Weird
.. zeek:namespace:: X509
.. zeek:namespace:: ZAM::Prof


:Namespaces: AF_Packet, Analyzer, BinPAC, Cluster, ConnKey, ConnThreshold, DCE_RPC, DHCP, EventMetadata, FTP, Finger, GLOBAL, Gnutella, HTTP, IP, JSON, KRB, Log, MIME, MOUNT3, MQTT, NCP, NFS3, NTLM, NTP, PE, POP3, Pcap, RADIUS, RDP, Reporter, SMB, SMB1, SMB2, SMTP, SNMP, SOCKS, SSH, SSL, Storage, TCP, Telemetry, Threading, Tunnel, UnknownProtocol, WebSocket, Weird, X509, ZAM::Prof
:Imports: :doc:`base/bif/CPP-load.bif.zeek </scripts/base/bif/CPP-load.bif.zeek>`, :doc:`base/bif/communityid.bif.zeek </scripts/base/bif/communityid.bif.zeek>`, :doc:`base/bif/const.bif.zeek </scripts/base/bif/const.bif.zeek>`, :doc:`base/bif/event.bif.zeek </scripts/base/bif/event.bif.zeek>`, :doc:`base/bif/mmdb.bif.zeek </scripts/base/bif/mmdb.bif.zeek>`, :doc:`base/bif/option.bif.zeek </scripts/base/bif/option.bif.zeek>`, :doc:`base/bif/packet_analysis.bif.zeek </scripts/base/bif/packet_analysis.bif.zeek>`, :doc:`base/bif/plugins/Zeek_KRB.types.bif.zeek </scripts/base/bif/plugins/Zeek_KRB.types.bif.zeek>`, :doc:`base/bif/plugins/Zeek_SNMP.types.bif.zeek </scripts/base/bif/plugins/Zeek_SNMP.types.bif.zeek>`, :doc:`base/bif/reporter.bif.zeek </scripts/base/bif/reporter.bif.zeek>`, :doc:`base/bif/stats.bif.zeek </scripts/base/bif/stats.bif.zeek>`, :doc:`base/bif/strings.bif.zeek </scripts/base/bif/strings.bif.zeek>`, :doc:`base/bif/supervisor.bif.zeek </scripts/base/bif/supervisor.bif.zeek>`, :doc:`base/bif/telemetry_functions.bif.zeek </scripts/base/bif/telemetry_functions.bif.zeek>`, :doc:`base/bif/telemetry_types.bif.zeek </scripts/base/bif/telemetry_types.bif.zeek>`, :doc:`base/bif/types.bif.zeek </scripts/base/bif/types.bif.zeek>`, :doc:`base/bif/zeek.bif.zeek </scripts/base/bif/zeek.bif.zeek>`, :doc:`base/frameworks/spicy/init-bare.zeek </scripts/base/frameworks/spicy/init-bare.zeek>`, :doc:`base/frameworks/supervisor/api.zeek </scripts/base/frameworks/supervisor/api.zeek>`, :doc:`base/packet-protocols </scripts/base/packet-protocols/index>`

Summary
~~~~~~~
Runtime Options
###############
============================================================================================================== =================================================================================
:zeek:id:`Cluster::default_table_publish_on_change_max_batch_delay`: :zeek:type:`interval` :zeek:attr:`&redef` Default maximum delay size for the the :zeek:attr:`&publish_on_change` attribute.
:zeek:id:`Cluster::default_table_publish_on_change_max_batch_size`: :zeek:type:`count` :zeek:attr:`&redef`     Default maximum batch size for the :zeek:attr:`&publish_on_change` attribute.
:zeek:id:`Finger::max_line_length`: :zeek:type:`count` :zeek:attr:`&redef`                                     The maximum line length for Finger requests and replies.
:zeek:id:`MQTT::max_payload_size`: :zeek:type:`count` :zeek:attr:`&redef`                                      The maximum payload size to allocate for the purpose of
                                                                                                               payload information in :zeek:see:`mqtt_publish` events (and the
                                                                                                               default MQTT logs generated from that).
:zeek:id:`Weird::sampling_duration`: :zeek:type:`interval` :zeek:attr:`&redef`                                 How long a weird of a given type is allowed to keep state/counters in
                                                                                                               memory.
:zeek:id:`Weird::sampling_global_list`: :zeek:type:`set` :zeek:attr:`&redef`                                   Rate-limits weird names in the table globally instead of per connection/flow.
:zeek:id:`Weird::sampling_rate`: :zeek:type:`count` :zeek:attr:`&redef`                                        The rate-limiting sampling rate.
:zeek:id:`Weird::sampling_threshold`: :zeek:type:`count` :zeek:attr:`&redef`                                   How many weirds of a given type to tolerate before sampling begins.
:zeek:id:`Weird::sampling_whitelist`: :zeek:type:`set` :zeek:attr:`&redef`                                     Prevents rate-limiting sampling of any weirds named in the table.
:zeek:id:`default_file_bof_buffer_size`: :zeek:type:`count` :zeek:attr:`&redef`                                Default amount of bytes that file analysis will buffer in order to use
                                                                                                               for mime type matching.
:zeek:id:`default_file_timeout_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                            Default amount of time a file can be inactive before the file analysis
                                                                                                               gives up and discards any internal state related to the file.
:zeek:id:`ignore_checksums_nets`: :zeek:type:`set` :zeek:attr:`&redef`                                         Checksums are ignored for all packets with a src address within this set of
                                                                                                               networks.
:zeek:id:`udp_content_delivery_ports_use_resp`: :zeek:type:`bool` :zeek:attr:`&redef`                          Whether ports given in :zeek:see:`udp_content_delivery_ports_orig`
                                                                                                               and :zeek:see:`udp_content_delivery_ports_resp` are in terms of
                                                                                                               UDP packet's destination port or the UDP connection's "responder"
                                                                                                               port.
:zeek:id:`udp_content_ports`: :zeek:type:`set` :zeek:attr:`&redef`                                             Defines UDP ports (source or destination) for which the contents of
                                                                                                               either originator or responder streams should be delivered via
                                                                                                               :zeek:see:`udp_contents`.
============================================================================================================== =================================================================================

Redefinable Options
###################
=================================================================================================================== ================================================================================
:zeek:id:`AF_Packet::block_size`: :zeek:type:`count` :zeek:attr:`&redef`                                            Size of an individual block.
:zeek:id:`AF_Packet::block_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                      Retire timeout for a single block.
:zeek:id:`AF_Packet::buffer_size`: :zeek:type:`count` :zeek:attr:`&redef`                                           Size of the ring-buffer.
:zeek:id:`AF_Packet::checksum_validation_mode`: :zeek:type:`AF_Packet::ChecksumMode` :zeek:attr:`&redef`            Checksum validation mode.
:zeek:id:`AF_Packet::enable_defrag`: :zeek:type:`bool` :zeek:attr:`&redef`                                          Toggle defragmentation of IP packets using PACKET_FANOUT_FLAG_DEFRAG.
:zeek:id:`AF_Packet::enable_fanout`: :zeek:type:`bool` :zeek:attr:`&redef`                                          Toggle whether to use PACKET_FANOUT.
:zeek:id:`AF_Packet::enable_hw_timestamping`: :zeek:type:`bool` :zeek:attr:`&redef`                                 Toggle whether to use hardware timestamps.
:zeek:id:`AF_Packet::fanout_id`: :zeek:type:`count` :zeek:attr:`&redef`                                             Fanout ID.
:zeek:id:`AF_Packet::fanout_mode`: :zeek:type:`AF_Packet::FanoutMode` :zeek:attr:`&redef`                           Fanout mode.
:zeek:id:`AF_Packet::link_type`: :zeek:type:`count` :zeek:attr:`&redef`                                             Link type (default Ethernet).
:zeek:id:`BinPAC::flowbuffer_capacity_max`: :zeek:type:`count` :zeek:attr:`&redef`                                  Maximum capacity, in bytes, that the BinPAC flowbuffer is allowed to
                                                                                                                    grow to for use with incremental parsing of a given connection/analyzer.
:zeek:id:`BinPAC::flowbuffer_capacity_min`: :zeek:type:`count` :zeek:attr:`&redef`                                  The initial capacity, in bytes, that will be allocated to the BinPAC
                                                                                                                    flowbuffer of a given connection/analyzer.
:zeek:id:`BinPAC::flowbuffer_contract_threshold`: :zeek:type:`count` :zeek:attr:`&redef`                            The threshold, in bytes, at which the BinPAC flowbuffer of a given
                                                                                                                    connection/analyzer will have its capacity contracted to
                                                                                                                    :zeek:see:`BinPAC::flowbuffer_capacity_min` after parsing a full unit.
:zeek:id:`Cluster::backend`: :zeek:type:`Cluster::BackendTag` :zeek:attr:`&redef`                                   Cluster backend to use.
:zeek:id:`Cluster::event_serializer`: :zeek:type:`Cluster::EventSerializerTag` :zeek:attr:`&redef`                  The event serializer to use by the cluster backend.
:zeek:id:`Cluster::log_serializer`: :zeek:type:`Cluster::LogSerializerTag` :zeek:attr:`&redef`                      The log serializer to use by the backend.
:zeek:id:`ConnKey::factory`: :zeek:type:`ConnKey::Tag` :zeek:attr:`&redef`                                          The connection key factory to use for Zeek's internal connection
                                                                                                                    tracking.
:zeek:id:`ConnThreshold::generic_packet_thresholds`: :zeek:type:`set` :zeek:attr:`&redef`                           Number of packets required to be observed on any IP-based session to
                                                                                                                    trigger :zeek:id:`conn_generic_packet_threshold_crossed`.
:zeek:id:`DCE_RPC::max_cmd_reassembly`: :zeek:type:`count` :zeek:attr:`&redef`                                      The maximum number of simultaneous fragmented commands that
                                                                                                                    the DCE_RPC analyzer will tolerate before the it will generate
                                                                                                                    a weird and skip further input.
:zeek:id:`DCE_RPC::max_frag_data`: :zeek:type:`count` :zeek:attr:`&redef`                                           The maximum number of fragmented bytes that the DCE_RPC analyzer
                                                                                                                    will tolerate on a command before the analyzer will generate a weird
                                                                                                                    and skip further input.
:zeek:id:`EventMetadata::add_missing_remote_network_timestamp`: :zeek:type:`bool` :zeek:attr:`&redef`               By default, remote events without network timestamp metadata
                                                                                                                    will yield a negative zeek:see:`current_event_time` during
                                                                                                                    processing.
:zeek:id:`EventMetadata::add_network_timestamp`: :zeek:type:`bool` :zeek:attr:`&redef`                              Add network timestamp metadata to all events.
:zeek:id:`FTP::max_command_length`: :zeek:type:`count` :zeek:attr:`&redef`                                          Limits the size of commands accepted by the FTP analyzer.
:zeek:id:`Gnutella::max_header_length`: :zeek:type:`count` :zeek:attr:`&redef`                                      Stop processing headers when the Gnutella headers hit this limit, with
                                                                                                                    all included lines.
:zeek:id:`Gnutella::max_line_length`: :zeek:type:`count` :zeek:attr:`&redef`                                        Stop processing lines that exceed this byte limit before encountering
                                                                                                                    a line terminator.
:zeek:id:`HTTP::upgrade_analyzers`: :zeek:type:`table` :zeek:attr:`&redef`                                          Lookup table for Upgrade analyzers.
:zeek:id:`IP::protocol_names`: :zeek:type:`table` :zeek:attr:`&redef` :zeek:attr:`&default` = :zeek:type:`function` Mapping from IP protocol identifier values to string names.
:zeek:id:`KRB::keytab`: :zeek:type:`string` :zeek:attr:`&redef`                                                     Kerberos keytab file name.
:zeek:id:`Log::default_max_field_container_elements`: :zeek:type:`count` :zeek:attr:`&redef`                        The maximum number of elements a single container field can contain when
                                                                                                                    logging.
:zeek:id:`Log::default_max_field_string_bytes`: :zeek:type:`count` :zeek:attr:`&redef`                              The maximum number of bytes that a single string field can contain when
                                                                                                                    logging.
:zeek:id:`Log::default_max_total_container_elements`: :zeek:type:`count` :zeek:attr:`&redef`                        The maximum total number of container elements a record may log.
:zeek:id:`Log::default_max_total_string_bytes`: :zeek:type:`count` :zeek:attr:`&redef`                              The maximum total bytes a record may log for string fields.
:zeek:id:`Log::flush_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                           Default interval for flushing the write buffers of all
                                                                                                                    enabled log streams.
:zeek:id:`Log::max_log_record_size`: :zeek:type:`count` :zeek:attr:`&redef`                                         Maximum size of a message that can be sent to a remote logger or logged
                                                                                                                    locally.
:zeek:id:`Log::write_buffer_size`: :zeek:type:`count` :zeek:attr:`&redef`                                           Default maximum size of the log write buffer per filter/path pair.
:zeek:id:`MIME::max_depth`: :zeek:type:`count` :zeek:attr:`&redef`                                                  Stop analysis of nested multipart MIME entities if this depth is
                                                                                                                    reached.
:zeek:id:`MIME::max_header_bytes`: :zeek:type:`count` :zeek:attr:`&redef`                                           Stop analysis of MIME headers that exceed this byte limit.
:zeek:id:`NCP::max_frame_size`: :zeek:type:`count` :zeek:attr:`&redef`                                              The maximum number of bytes to allocate when parsing NCP frames.
:zeek:id:`NFS3::return_data`: :zeek:type:`bool` :zeek:attr:`&redef`                                                 If true, :zeek:see:`nfs_proc_read` and :zeek:see:`nfs_proc_write`
                                                                                                                    events return the file data that has been read/written.
:zeek:id:`NFS3::return_data_first_only`: :zeek:type:`bool` :zeek:attr:`&redef`                                      If :zeek:id:`NFS3::return_data` is true, whether to *only* return data
                                                                                                                    if the read or write offset is 0, i.e., only return data for the
                                                                                                                    beginning of the file.
:zeek:id:`NFS3::return_data_max`: :zeek:type:`count` :zeek:attr:`&redef`                                            If :zeek:id:`NFS3::return_data` is true, how much data should be
                                                                                                                    returned at most.
:zeek:id:`POP3::max_pending_commands`: :zeek:type:`count` :zeek:attr:`&redef`                                       How many commands a POP3 client may have pending
                                                                                                                    before Zeek forcefully removes the oldest.
:zeek:id:`POP3::max_unknown_client_commands`: :zeek:type:`count` :zeek:attr:`&redef`                                How many invalid commands a POP3 client may use
                                                                                                                    before Zeek starts raising analyzer violations.
:zeek:id:`Pcap::bufsize`: :zeek:type:`count` :zeek:attr:`&redef`                                                    Number of Mbytes to provide as buffer space when capturing from live
                                                                                                                    interfaces.
:zeek:id:`Pcap::bufsize_offline_bytes`: :zeek:type:`count` :zeek:attr:`&redef`                                      Number of bytes to use for buffering file read operations when reading
                                                                                                                    from a PCAP file.
:zeek:id:`Pcap::non_fd_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                          Default timeout for packet sources without file descriptors.
:zeek:id:`Pcap::snaplen`: :zeek:type:`count` :zeek:attr:`&redef`                                                    Number of bytes per packet to capture from live interfaces.
:zeek:id:`Reporter::errors_to_stderr`: :zeek:type:`bool` :zeek:attr:`&redef`                                        Tunable for sending reporter error messages to STDERR.
:zeek:id:`Reporter::info_to_stderr`: :zeek:type:`bool` :zeek:attr:`&redef`                                          Tunable for sending reporter info messages to STDERR.
:zeek:id:`Reporter::warnings_to_stderr`: :zeek:type:`bool` :zeek:attr:`&redef`                                      Tunable for sending reporter warning messages to STDERR.
:zeek:id:`SMB::max_andx_depth`: :zeek:type:`count` :zeek:attr:`&redef`                                              Maximum number of AndX commands that are allowed in a chain.
:zeek:id:`SMB::max_dce_rpc_analyzers`: :zeek:type:`count` :zeek:attr:`&redef`                                       Maximum number of DCE-RPC analyzers per connection
                                                                                                                    before discarding them to avoid unbounded state growth.
:zeek:id:`SMB::max_pending_messages`: :zeek:type:`count` :zeek:attr:`&redef`                                        The maximum number of messages for which to retain state
                                                                                                                    about offsets, fids, or tree ids within the parser.
:zeek:id:`SMB::pipe_filenames`: :zeek:type:`set` :zeek:attr:`&redef`                                                A set of file names used as named pipes over SMB.
:zeek:id:`SMTP::bdat_max_line_length`: :zeek:type:`count` :zeek:attr:`&redef`                                       The maximum line length within a BDAT chunk before a forceful linebreak
                                                                                                                    is introduced and a weird is raised.
:zeek:id:`SMTP::enable_rfc822_msg_file_analysis`: :zeek:type:`bool` :zeek:attr:`&redef`                             Whether to send data of individual top-level RFC822 messages
                                                                                                                    in SMTP transactions to the file analysis framework.
:zeek:id:`SSH::max_kexinit_compression_algorithms`: :zeek:type:`count` :zeek:attr:`&redef`                          The maximum number of compression algorithms extracted from a
                                                                                                                    KEXINIT packet and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_kexinit_encryption_algorithms`: :zeek:type:`count` :zeek:attr:`&redef`                           The maximum number of encryption algorithms extracted from a
                                                                                                                    KEXINIT packet and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_kexinit_hostkey_algorithms`: :zeek:type:`count` :zeek:attr:`&redef`                              The maximum number of hostkey algorithms extracted from a
                                                                                                                    KEXINIT packet and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_kexinit_kex_algorithms`: :zeek:type:`count` :zeek:attr:`&redef`                                  The maximum number of KEX algorithms extracted from a KEXINIT packet
                                                                                                                    and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_kexinit_languages`: :zeek:type:`count` :zeek:attr:`&redef`                                       The maximum number of languages extracted from a
                                                                                                                    KEXINIT packet and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_kexinit_mac_algorithms`: :zeek:type:`count` :zeek:attr:`&redef`                                  The maximum number of mac algorithms extracted from a
                                                                                                                    KEXINIT packet and included in the ``ssh_capabilities`` event.
:zeek:id:`SSH::max_packet_length`: :zeek:type:`count` :zeek:attr:`&redef`                                           When the SSH analyzer observes packets with a packet length
                                                                                                                    field that exceeds below value, it truncates the length to
                                                                                                                    the limit and raises a ``SSH_max_packet_exceeded`` weird.
:zeek:id:`SSH::max_string_length`: :zeek:type:`count` :zeek:attr:`&redef`                                           When the SSH analyzer observes SSH string fields with lengths
                                                                                                                    that exceeds below value, it truncates the length to
                                                                                                                    the limit and raises a ``SSH_max_string_length_exceeded`` weird.
:zeek:id:`SSL::dtls_max_reported_version_errors`: :zeek:type:`count` :zeek:attr:`&redef`                            Maximum number of invalid version errors to report in one DTLS connection.
:zeek:id:`SSL::dtls_max_version_errors`: :zeek:type:`count` :zeek:attr:`&redef`                                     Number of non-DTLS frames that can occur in a DTLS connection before
                                                                                                                    parsing of the connection is suspended.
:zeek:id:`SSL::max_alerts_per_record`: :zeek:type:`count` :zeek:attr:`&redef`                                       Maximum number of Alert messages parsed from an SSL record with
                                                                                                                    content_type alert (21).
:zeek:id:`Storage::expire_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                      The interval used by the storage framework for automatic expiration
                                                                                                                    of elements in all backends that don't support it natively, or if
                                                                                                                    using expiration while reading pcap files.
:zeek:id:`Telemetry::callback_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                   Maximum amount of time for CivetWeb HTTP threads to
                                                                                                                    wait for metric callbacks to complete on the IO loop.
:zeek:id:`Telemetry::civetweb_threads`: :zeek:type:`count` :zeek:attr:`&redef`                                      Number of CivetWeb threads to use.
:zeek:id:`Threading::heartbeat_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                 The heartbeat interval used by the threading framework.
:zeek:id:`Tunnel::delay_gtp_confirmation`: :zeek:type:`bool` :zeek:attr:`&redef`                                    With this set, the GTP analyzer waits until the most-recent upflow
                                                                                                                    and downflow packets are a valid GTPv1 encapsulation before
                                                                                                                    issuing :zeek:see:`analyzer_confirmation_info`.
:zeek:id:`Tunnel::delay_teredo_confirmation`: :zeek:type:`bool` :zeek:attr:`&redef`                                 With this set, the Teredo analyzer waits until it sees both sides
                                                                                                                    of a connection using a valid Teredo encapsulation before issuing
                                                                                                                    a :zeek:see:`analyzer_confirmation_info`.
:zeek:id:`Tunnel::ip_tunnel_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                     How often to cleanup internal state for inactive IP tunnels
                                                                                                                    (includes GRE tunnels).
:zeek:id:`Tunnel::max_changes_per_connection`: :zeek:type:`count` :zeek:attr:`&redef`                               The number of tunnel_changed events that will be sent for a connection.
:zeek:id:`Tunnel::max_depth`: :zeek:type:`count` :zeek:attr:`&redef`                                                The maximum depth of a tunnel to decapsulate until giving up.
:zeek:id:`Tunnel::validate_vxlan_checksums`: :zeek:type:`bool` :zeek:attr:`&redef`                                  Whether to validate the checksum supplied in the outer UDP header
                                                                                                                    of a VXLAN encapsulation.
:zeek:id:`UnknownProtocol::first_bytes_count`: :zeek:type:`count` :zeek:attr:`&redef`                               The number of bytes to extract from the next header and log in the
                                                                                                                    first bytes field.
:zeek:id:`UnknownProtocol::sampling_duration`: :zeek:type:`interval` :zeek:attr:`&redef`                            How long an analyzer/protocol pair is allowed to keep state/counters in
                                                                                                                    in memory.
:zeek:id:`UnknownProtocol::sampling_rate`: :zeek:type:`count` :zeek:attr:`&redef`                                   The rate-limiting sampling rate.
:zeek:id:`UnknownProtocol::sampling_threshold`: :zeek:type:`count` :zeek:attr:`&redef`                              How many reports for an analyzer/protocol pair will be allowed to
                                                                                                                    raise events before becoming rate-limited.
:zeek:id:`WebSocket::max_control_frame_size`: :zeek:type:`count` :zeek:attr:`&redef`                                The WebSocket analyzer will cap any control frames
                                                                                                                    (CLOSE, PING, PONG) to this limit and emit a weird if
                                                                                                                    exceeded.
:zeek:id:`WebSocket::payload_chunk_size`: :zeek:type:`count` :zeek:attr:`&redef`                                    The WebSocket analyzer consumes and forwards
                                                                                                                    frame payload in chunks to keep memory usage
                                                                                                                    bounded.
:zeek:id:`WebSocket::use_dpd_default`: :zeek:type:`bool` :zeek:attr:`&redef`                                        Whether to enable DPD on WebSocket frame payload by default.
:zeek:id:`WebSocket::use_spicy_analyzer`: :zeek:type:`bool` :zeek:attr:`&redef`                                     Whether to use the Spicy WebSocket protocol analyzer.
:zeek:id:`allow_network_time_forward`: :zeek:type:`bool` :zeek:attr:`&redef`                                        Whether Zeek will forward network_time to the current time upon
                                                                                                                    observing an idle packet source (or no configured packet source).
:zeek:id:`bits_per_uid`: :zeek:type:`count` :zeek:attr:`&redef`                                                     Number of bits in UIDs that are generated to identify connections and
                                                                                                                    files.
:zeek:id:`cmd_line_bpf_filter`: :zeek:type:`string` :zeek:attr:`&redef`                                             BPF filter the user has set via the -f command line options.
:zeek:id:`detect_filtered_trace`: :zeek:type:`bool` :zeek:attr:`&redef`                                             Whether to attempt to automatically detect SYN/FIN/RST-filtered trace
                                                                                                                    and not report missing segments for such connections.
:zeek:id:`digest_salt`: :zeek:type:`string` :zeek:attr:`&redef`                                                     This salt value is used for several message digests in Zeek.
:zeek:id:`dns_session_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                           Time to wait before timing out a DNS request.
:zeek:id:`dpd_buffer_size`: :zeek:type:`count` :zeek:attr:`&redef`                                                  Size of per-connection buffer used for dynamic protocol detection.
:zeek:id:`dpd_ignore_ports`: :zeek:type:`bool` :zeek:attr:`&redef`                                                  If true, don't consider any ports for deciding which protocol analyzer to
                                                                                                                    use.
:zeek:id:`dpd_late_match_stop`: :zeek:type:`bool` :zeek:attr:`&redef`                                               If true, stops signature matching after a late match.
:zeek:id:`dpd_match_only_beginning`: :zeek:type:`bool` :zeek:attr:`&redef`                                          If true, stops signature matching if :zeek:see:`dpd_buffer_size` has been
                                                                                                                    reached.
:zeek:id:`dpd_max_packets`: :zeek:type:`count` :zeek:attr:`&redef`                                                  Maximum number of per-connection packets that will be buffered for dynamic
                                                                                                                    protocol detection.
:zeek:id:`dpd_reassemble_first_packets`: :zeek:type:`bool` :zeek:attr:`&redef`                                      Reassemble the beginning of all TCP connections before doing
                                                                                                                    signature matching.
:zeek:id:`exit_only_after_terminate`: :zeek:type:`bool` :zeek:attr:`&redef`                                         Flag to prevent Zeek from exiting automatically when input is exhausted.
:zeek:id:`expensive_profiling_multiple`: :zeek:type:`count` :zeek:attr:`&redef`                                     Multiples of :zeek:see:`profiling_interval` at which (more expensive) memory
                                                                                                                    profiling is done (0 disables).
:zeek:id:`frag_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                                  How long to hold onto fragments for possible reassembly.
:zeek:id:`global_hash_seed`: :zeek:type:`string` :zeek:attr:`&redef`                                                Seed for hashes computed internally for probabilistic data structures.
:zeek:id:`icmp_inactivity_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                       If an ICMP flow is inactive, time it out after this interval.
:zeek:id:`ignore_checksums`: :zeek:type:`bool` :zeek:attr:`&redef`                                                  If true, don't verify checksums, and accept packets that give a length of
                                                                                                                    zero in the IPv4 header.
:zeek:id:`ignore_keep_alive_rexmit`: :zeek:type:`bool` :zeek:attr:`&redef`                                          Ignore certain TCP retransmissions for :zeek:see:`conn_stats`.
:zeek:id:`io_poll_interval_default`: :zeek:type:`count` :zeek:attr:`&redef`                                         How many rounds to go without checking IO sources with file descriptors
                                                                                                                    for readiness by default.
:zeek:id:`io_poll_interval_live`: :zeek:type:`count` :zeek:attr:`&redef`                                            How often to check IO sources with file descriptors for readiness when
                                                                                                                    monitoring with a live packet source.
:zeek:id:`likely_server_ports`: :zeek:type:`set` :zeek:attr:`&redef`                                                Ports which the core considers being likely used by servers.
:zeek:id:`log_rotate_base_time`: :zeek:type:`string` :zeek:attr:`&redef`                                            Base time of log rotations in 24-hour time format (``%H:%M``), e.g.
:zeek:id:`max_analyzer_violations`: :zeek:type:`count` :zeek:attr:`&redef`                                          The maximum number of analyzer violations the core generates before
                                                                                                                    suppressing them for a given analyzer instance.
:zeek:id:`max_find_all_string_length`: :zeek:type:`int` :zeek:attr:`&redef`                                         Maximum string length allowed for calls to the :zeek:see:`find_all` and
                                                                                                                    :zeek:see:`find_all_ordered` BIFs.
:zeek:id:`max_timer_expires`: :zeek:type:`count` :zeek:attr:`&redef`                                                The maximum number of expired timers to process after processing each new
                                                                                                                    packet.
:zeek:id:`mmdb_asn_db`: :zeek:type:`string` :zeek:attr:`&redef`                                                     Default name of the MaxMind ASN database file:
:zeek:id:`mmdb_city_db`: :zeek:type:`string` :zeek:attr:`&redef`                                                    Default name of the MaxMind City database file:
:zeek:id:`mmdb_country_db`: :zeek:type:`string` :zeek:attr:`&redef`                                                 Default name of the MaxMind Country database file:
:zeek:id:`mmdb_dir`: :zeek:type:`string` :zeek:attr:`&redef`                                                        The directory containing MaxMind DB (.mmdb) files to use for GeoIP support.
:zeek:id:`mmdb_dir_fallbacks`: :zeek:type:`vector` :zeek:attr:`&redef`                                              Fallback locations for MaxMind databases.
:zeek:id:`mmdb_stale_check_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                     Sets the interval for MaxMind DB file staleness checks.
:zeek:id:`netbios_ssn_session_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                   The amount of time before a connection created by the netbios analyzer times
                                                                                                                    out and is removed.
:zeek:id:`non_analyzed_lifetime`: :zeek:type:`interval` :zeek:attr:`&redef`                                         If a connection belongs to an application that we don't analyze,
                                                                                                                    time it out after this interval.
:zeek:id:`packet_filter_default`: :zeek:type:`bool` :zeek:attr:`&redef`                                             Default mode for Zeek's user-space dynamic packet filter.
:zeek:id:`packet_source_inactivity_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                              If a packet source does not yield packets for this amount of time,
                                                                                                                    it is considered idle.
:zeek:id:`partial_connection_ok`: :zeek:type:`bool` :zeek:attr:`&redef`                                             If true, instantiate connection state when a partial connection
                                                                                                                    (one missing its initial establishment negotiation) is seen.
:zeek:id:`peer_description`: :zeek:type:`string` :zeek:attr:`&redef`                                                Description transmitted to remote communication peers for identification.
:zeek:id:`pkt_profile_freq`: :zeek:type:`double` :zeek:attr:`&redef`                                                Frequency associated with packet profiling.
:zeek:id:`pkt_profile_mode`: :zeek:type:`pkt_profile_modes` :zeek:attr:`&redef`                                     Output mode for packet profiling information.
:zeek:id:`profiling_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                            Update interval for profiling (0 disables).
:zeek:id:`record_all_packets`: :zeek:type:`bool` :zeek:attr:`&redef`                                                If a trace file is given with ``-w``, dump *all* packets seen by Zeek into it.
:zeek:id:`report_gaps_for_partial`: :zeek:type:`bool` :zeek:attr:`&redef`                                           Whether we want :zeek:see:`content_gap` for partial
                                                                                                                    connections.
:zeek:id:`rpc_max_pending_calls`: :zeek:type:`count` :zeek:attr:`&redef`                                            Maximum number of pending RPC calls without replies.
:zeek:id:`rpc_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                                   Time to wait before timing out an RPC request.
:zeek:id:`running_under_test`: :zeek:type:`bool` :zeek:attr:`&redef`                                                Whether Zeek is being run under test.
:zeek:id:`sig_max_group_size`: :zeek:type:`count` :zeek:attr:`&redef`                                               Maximum size of regular expression groups for signature matching.
:zeek:id:`skip_http_data`: :zeek:type:`bool` :zeek:attr:`&redef`                                                    Skip HTTP data for performance considerations.
:zeek:id:`table_expire_delay`: :zeek:type:`interval` :zeek:attr:`&redef`                                            When expiring table entries, wait this amount of time before checking the
                                                                                                                    next chunk of entries.
:zeek:id:`table_expire_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                         Check for expired table entries after this amount of time.
:zeek:id:`table_incremental_step`: :zeek:type:`count` :zeek:attr:`&redef`                                           When expiring/serializing table entries, don't work on more than this many
                                                                                                                    table entries at a time.
:zeek:id:`tcp_SYN_ack_ok`: :zeek:type:`bool` :zeek:attr:`&redef`                                                    If true, instantiate connection state when a SYN/ACK is seen but not the
                                                                                                                    initial SYN (even if :zeek:see:`partial_connection_ok` is false).
:zeek:id:`tcp_SYN_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                               Check up on the result of an initial SYN after this much time.
:zeek:id:`tcp_attempt_delay`: :zeek:type:`interval` :zeek:attr:`&redef`                                             Wait this long upon seeing an initial SYN before timing out the
                                                                                                                    connection attempt.
:zeek:id:`tcp_close_delay`: :zeek:type:`interval` :zeek:attr:`&redef`                                               Upon seeing a normal connection close, flush state after this much time.
:zeek:id:`tcp_connection_linger`: :zeek:type:`interval` :zeek:attr:`&redef`                                         When checking a closed connection for further activity, consider it
                                                                                                                    inactive if there hasn't been any for this long.
:zeek:id:`tcp_content_deliver_all_orig`: :zeek:type:`bool` :zeek:attr:`&redef`                                      If true, all TCP originator-side traffic is reported via
                                                                                                                    :zeek:see:`tcp_contents`.
:zeek:id:`tcp_content_deliver_all_resp`: :zeek:type:`bool` :zeek:attr:`&redef`                                      If true, all TCP responder-side traffic is reported via
                                                                                                                    :zeek:see:`tcp_contents`.
:zeek:id:`tcp_content_delivery_ports_orig`: :zeek:type:`table` :zeek:attr:`&redef`                                  Defines destination TCP ports for which the contents of the originator stream
                                                                                                                    should be delivered via :zeek:see:`tcp_contents`.
:zeek:id:`tcp_content_delivery_ports_resp`: :zeek:type:`table` :zeek:attr:`&redef`                                  Defines destination TCP ports for which the contents of the responder stream
                                                                                                                    should be delivered via :zeek:see:`tcp_contents`.
:zeek:id:`tcp_excessive_data_without_further_acks`: :zeek:type:`count` :zeek:attr:`&redef`                          If we've seen this much data without any of it being acked, we give up
                                                                                                                    on that connection to avoid memory exhaustion due to buffering all that
                                                                                                                    stuff.
:zeek:id:`tcp_inactivity_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                        If a TCP connection is inactive, time it out after this interval.
:zeek:id:`tcp_match_undelivered`: :zeek:type:`bool` :zeek:attr:`&redef`                                             If true, pass any undelivered to the signature engine before flushing the state.
:zeek:id:`tcp_max_above_hole_without_any_acks`: :zeek:type:`count` :zeek:attr:`&redef`                              If we're not seeing our peer's ACKs, the maximum volume of data above a
                                                                                                                    sequence hole that we'll tolerate before assuming that there's been a packet
                                                                                                                    drop and we should give up on tracking a connection.
:zeek:id:`tcp_max_initial_window`: :zeek:type:`count` :zeek:attr:`&redef`                                           Maximum amount of data that might plausibly be sent in an initial flight
                                                                                                                    (prior to receiving any acks).
:zeek:id:`tcp_max_old_segments`: :zeek:type:`count` :zeek:attr:`&redef`                                             Number of TCP segments to buffer beyond what's been acknowledged already
                                                                                                                    to detect retransmission inconsistencies.
:zeek:id:`tcp_partial_close_delay`: :zeek:type:`interval` :zeek:attr:`&redef`                                       Generate a :zeek:id:`connection_partial_close` event this much time after one
                                                                                                                    half of a partial connection closes, assuming there has been no subsequent
                                                                                                                    activity.
:zeek:id:`tcp_reset_delay`: :zeek:type:`interval` :zeek:attr:`&redef`                                               Upon seeing a RST, flush state after this much time.
:zeek:id:`tcp_session_timer`: :zeek:type:`interval` :zeek:attr:`&redef`                                             After a connection has closed, wait this long for further activity
                                                                                                                    before checking whether to time out its state.
:zeek:id:`tcp_storm_interarrival_thresh`: :zeek:type:`interval` :zeek:attr:`&redef`                                 FINs/RSTs must come with this much time or less between them to be
                                                                                                                    considered a "storm".
:zeek:id:`tcp_storm_thresh`: :zeek:type:`count` :zeek:attr:`&redef`                                                 Number of FINs/RSTs in a row that constitute a "storm".
:zeek:id:`truncate_http_URI`: :zeek:type:`int` :zeek:attr:`&redef`                                                  Maximum length of HTTP URIs passed to events.
:zeek:id:`udp_content_deliver_all_orig`: :zeek:type:`bool` :zeek:attr:`&redef`                                      If true, all UDP originator-side traffic is reported via
                                                                                                                    :zeek:see:`udp_contents`.
:zeek:id:`udp_content_deliver_all_resp`: :zeek:type:`bool` :zeek:attr:`&redef`                                      If true, all UDP responder-side traffic is reported via
                                                                                                                    :zeek:see:`udp_contents`.
:zeek:id:`udp_content_delivery_ports_orig`: :zeek:type:`table` :zeek:attr:`&redef`                                  Defines UDP destination ports for which the contents of the originator stream
                                                                                                                    should be delivered via :zeek:see:`udp_contents`.
:zeek:id:`udp_content_delivery_ports_resp`: :zeek:type:`table` :zeek:attr:`&redef`                                  Defines UDP destination ports for which the contents of the responder stream
                                                                                                                    should be delivered via :zeek:see:`udp_contents`.
:zeek:id:`udp_inactivity_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                        If a UDP flow is inactive, time it out after this interval.
:zeek:id:`unknown_ip_inactivity_timeout`: :zeek:type:`interval` :zeek:attr:`&redef`                                 If a flow with an unknown IP-based protocol is inactive, time it out after
                                                                                                                    this interval.
:zeek:id:`use_conn_size_analyzer`: :zeek:type:`bool` :zeek:attr:`&redef`                                            Whether to use the ``ConnSize`` analyzer to count the number of packets and
                                                                                                                    IP-level bytes transferred by each endpoint.
:zeek:id:`watchdog_interval`: :zeek:type:`interval` :zeek:attr:`&redef`                                             Zeek's watchdog interval.
=================================================================================================================== ================================================================================

Constants
#########
=========================================================== =======================================================================
:zeek:id:`CONTENTS_BOTH`: :zeek:type:`count`                Record both originator and responder contents.
:zeek:id:`CONTENTS_NONE`: :zeek:type:`count`                Turn off recording of contents.
:zeek:id:`CONTENTS_ORIG`: :zeek:type:`count`                Record originator contents.
:zeek:id:`CONTENTS_RESP`: :zeek:type:`count`                Record responder contents.
:zeek:id:`DNS_ADDL`: :zeek:type:`count`                     An additional record.
:zeek:id:`DNS_ANS`: :zeek:type:`count`                      An answer record.
:zeek:id:`DNS_AUTH`: :zeek:type:`count`                     An authoritative record.
:zeek:id:`DNS_PREREQUISITE`: :zeek:type:`count`             A prerequisite record for dynamic update.
:zeek:id:`DNS_QUERY`: :zeek:type:`count`                    A query.
:zeek:id:`DNS_UPDATE`: :zeek:type:`count`                   A update record for dynamic update.
:zeek:id:`ENDIAN_BIG`: :zeek:type:`count`                   Big endian.
:zeek:id:`ENDIAN_CONFUSED`: :zeek:type:`count`              Tried to determine endian, but failed.
:zeek:id:`ENDIAN_LITTLE`: :zeek:type:`count`                Little endian.
:zeek:id:`ENDIAN_UNKNOWN`: :zeek:type:`count`               Endian not yet determined.
:zeek:id:`ICMP_UNREACH_ADMIN_PROHIB`: :zeek:type:`count`    Administratively prohibited.
:zeek:id:`ICMP_UNREACH_HOST`: :zeek:type:`count`            Host unreachable.
:zeek:id:`ICMP_UNREACH_NEEDFRAG`: :zeek:type:`count`        Fragment needed.
:zeek:id:`ICMP_UNREACH_NET`: :zeek:type:`count`             Network unreachable.
:zeek:id:`ICMP_UNREACH_PORT`: :zeek:type:`count`            Port unreachable.
:zeek:id:`ICMP_UNREACH_PROTOCOL`: :zeek:type:`count`        Protocol unreachable.
:zeek:id:`IPPROTO_AH`: :zeek:type:`count`                   IPv6 authentication header.
:zeek:id:`IPPROTO_DSTOPTS`: :zeek:type:`count`              IPv6 destination options header.
:zeek:id:`IPPROTO_ESP`: :zeek:type:`count`                  IPv6 encapsulating security payload header.
:zeek:id:`IPPROTO_FRAGMENT`: :zeek:type:`count`             IPv6 fragment header.
:zeek:id:`IPPROTO_HOPOPTS`: :zeek:type:`count`              IPv6 hop-by-hop-options header.
:zeek:id:`IPPROTO_ICMP`: :zeek:type:`count`                 Control message protocol.
:zeek:id:`IPPROTO_ICMPV6`: :zeek:type:`count`               ICMP for IPv6.
:zeek:id:`IPPROTO_IGMP`: :zeek:type:`count`                 Group management protocol.
:zeek:id:`IPPROTO_IP`: :zeek:type:`count`                   Dummy for IP.
:zeek:id:`IPPROTO_IPIP`: :zeek:type:`count`                 IP encapsulation in IP.
:zeek:id:`IPPROTO_IPV6`: :zeek:type:`count`                 IPv6 header.
:zeek:id:`IPPROTO_MOBILITY`: :zeek:type:`count`             IPv6 mobility header.
:zeek:id:`IPPROTO_NONE`: :zeek:type:`count`                 IPv6 no next header.
:zeek:id:`IPPROTO_RAW`: :zeek:type:`count`                  Raw IP packet.
:zeek:id:`IPPROTO_ROUTING`: :zeek:type:`count`              IPv6 routing header.
:zeek:id:`IPPROTO_TCP`: :zeek:type:`count`                  TCP.
:zeek:id:`IPPROTO_UDP`: :zeek:type:`count`                  User datagram protocol.
:zeek:id:`LOGIN_STATE_AUTHENTICATE`: :zeek:type:`count`
:zeek:id:`LOGIN_STATE_CONFUSED`: :zeek:type:`count`
:zeek:id:`LOGIN_STATE_LOGGED_IN`: :zeek:type:`count`
:zeek:id:`LOGIN_STATE_SKIP`: :zeek:type:`count`
:zeek:id:`RPC_status`: :zeek:type:`table`                   Mapping of numerical RPC status codes to readable messages.
:zeek:id:`SNMP::OBJ_COUNTER32_TAG`: :zeek:type:`count`      Unsigned 32-bit integer.
:zeek:id:`SNMP::OBJ_COUNTER64_TAG`: :zeek:type:`count`      Unsigned 64-bit integer.
:zeek:id:`SNMP::OBJ_ENDOFMIBVIEW_TAG`: :zeek:type:`count`   A NULL value.
:zeek:id:`SNMP::OBJ_INTEGER_TAG`: :zeek:type:`count`        Signed 64-bit integer.
:zeek:id:`SNMP::OBJ_IPADDRESS_TAG`: :zeek:type:`count`      An IP address.
:zeek:id:`SNMP::OBJ_NOSUCHINSTANCE_TAG`: :zeek:type:`count` A NULL value.
:zeek:id:`SNMP::OBJ_NOSUCHOBJECT_TAG`: :zeek:type:`count`   A NULL value.
:zeek:id:`SNMP::OBJ_OCTETSTRING_TAG`: :zeek:type:`count`    An octet string.
:zeek:id:`SNMP::OBJ_OID_TAG`: :zeek:type:`count`            An Object Identifier.
:zeek:id:`SNMP::OBJ_OPAQUE_TAG`: :zeek:type:`count`         An octet string.
:zeek:id:`SNMP::OBJ_TIMETICKS_TAG`: :zeek:type:`count`      Unsigned 32-bit integer.
:zeek:id:`SNMP::OBJ_UNSIGNED32_TAG`: :zeek:type:`count`     Unsigned 32-bit integer.
:zeek:id:`SNMP::OBJ_UNSPECIFIED_TAG`: :zeek:type:`count`    A NULL value.
:zeek:id:`TCP_CLOSED`: :zeek:type:`count`                   Endpoint has closed connection.
:zeek:id:`TCP_ESTABLISHED`: :zeek:type:`count`              Endpoint has finished initial handshake regularly.
:zeek:id:`TCP_INACTIVE`: :zeek:type:`count`                 Error string if unsuccessful.
:zeek:id:`TCP_PARTIAL`: :zeek:type:`count`                  Endpoint has sent data but no initial SYN.
:zeek:id:`TCP_RESET`: :zeek:type:`count`                    Endpoint has sent RST.
:zeek:id:`TCP_SYN_ACK_SENT`: :zeek:type:`count`             Endpoint has sent SYN/ACK.
:zeek:id:`TCP_SYN_SENT`: :zeek:type:`count`                 Endpoint has sent SYN.
:zeek:id:`TH_ACK`: :zeek:type:`count`                       ACK.
:zeek:id:`TH_FIN`: :zeek:type:`count`                       FIN.
:zeek:id:`TH_FLAGS`: :zeek:type:`count`                     Mask combining all flags.
:zeek:id:`TH_PUSH`: :zeek:type:`count`                      PUSH.
:zeek:id:`TH_RST`: :zeek:type:`count`                       RST.
:zeek:id:`TH_SYN`: :zeek:type:`count`                       SYN.
:zeek:id:`TH_URG`: :zeek:type:`count`                       URG.
:zeek:id:`UDP_ACTIVE`: :zeek:type:`count`                   Endpoint has sent something.
:zeek:id:`UDP_INACTIVE`: :zeek:type:`count`                 Endpoint is still inactive.
:zeek:id:`trace_output_file`: :zeek:type:`string`           Holds the filename of the trace file given with ``-w`` (empty if none).
:zeek:id:`zeek_script_args`: :zeek:type:`vector`            Arguments given to Zeek from the command line.
=========================================================== =======================================================================

State Variables
###############
=========================================================================================================================== ============================================================================
:zeek:id:`capture_filters`: :zeek:type:`table` :zeek:attr:`&redef`                                                          Set of BPF capture filters to use for capturing, indexed by a user-definable
                                                                                                                            ID (which must be unique).
:zeek:id:`direct_login_prompts`: :zeek:type:`set` :zeek:attr:`&redef`                                                       TODO.
:zeek:id:`discarder_maxlen`: :zeek:type:`count` :zeek:attr:`&redef`                                                         Maximum length of payload passed to discarder functions.
:zeek:id:`dns_max_compression_chain_depth`: :zeek:type:`count` :zeek:attr:`&redef`                                          The maximum depth of a compression chain in DNS.
:zeek:id:`dns_max_queries`: :zeek:type:`count` :zeek:attr:`&redef`                                                          If a DNS request includes more than this many queries, assume it's non-DNS
                                                                                                                            traffic and do not process it.
:zeek:id:`dns_skip_addl`: :zeek:type:`set` :zeek:attr:`&redef`                                                              For DNS servers in these sets, omit processing the ADDL records they include
                                                                                                                            in their replies.
:zeek:id:`dns_skip_all_addl`: :zeek:type:`bool` :zeek:attr:`&redef`                                                         If true, all DNS ADDL records are skipped.
:zeek:id:`dns_skip_all_auth`: :zeek:type:`bool` :zeek:attr:`&redef`                                                         If true, all DNS AUTH records are skipped.
:zeek:id:`dns_skip_auth`: :zeek:type:`set` :zeek:attr:`&redef`                                                              For DNS servers in these sets, omit processing the AUTH records they include
                                                                                                                            in their replies.
:zeek:id:`done_with_network`: :zeek:type:`bool`
:zeek:id:`http_entity_data_delivery_size`: :zeek:type:`count` :zeek:attr:`&redef`                                           Maximum number of HTTP entity data delivered to events.
:zeek:id:`interfaces`: :zeek:type:`string` :zeek:attr:`&add_func` = :zeek:see:`add_interface` :zeek:attr:`&redef`           Network interfaces to listen on.
:zeek:id:`login_failure_msgs`: :zeek:type:`set` :zeek:attr:`&redef`                                                         TODO.
:zeek:id:`login_non_failure_msgs`: :zeek:type:`set` :zeek:attr:`&redef`                                                     TODO.
:zeek:id:`login_prompts`: :zeek:type:`set` :zeek:attr:`&redef`                                                              TODO.
:zeek:id:`login_success_msgs`: :zeek:type:`set` :zeek:attr:`&redef`                                                         TODO.
:zeek:id:`login_timeouts`: :zeek:type:`set` :zeek:attr:`&redef`                                                             TODO.
:zeek:id:`mime_segment_length`: :zeek:type:`count` :zeek:attr:`&redef`                                                      The length of MIME data segments delivered to handlers of
                                                                                                                            :zeek:see:`mime_segment_data`.
:zeek:id:`mime_segment_overlap_length`: :zeek:type:`count` :zeek:attr:`&redef`                                              The number of bytes of overlap between successive segments passed to
                                                                                                                            :zeek:see:`mime_segment_data`.
:zeek:id:`pkt_profile_file`: :zeek:type:`file` :zeek:attr:`&redef`                                                          File where packet profiles are logged.
:zeek:id:`profiling_file`: :zeek:type:`file` :zeek:attr:`&redef`                                                            Write profiling info into this file in regular intervals.
:zeek:id:`restrict_filters`: :zeek:type:`table` :zeek:attr:`&redef`                                                         Set of BPF filters to restrict capturing, indexed by a user-definable ID
                                                                                                                            (which must be unique).
:zeek:id:`secondary_filters`: :zeek:type:`table` :zeek:attr:`&redef`                                                        Definition of "secondary filters".
:zeek:id:`signature_files`: :zeek:type:`string` :zeek:attr:`&add_func` = :zeek:see:`add_signature_file` :zeek:attr:`&redef` Signature files to read.
:zeek:id:`skip_authentication`: :zeek:type:`set` :zeek:attr:`&redef`                                                        TODO.
=========================================================================================================================== ============================================================================

Types
#####
================================================================================ =======================================================================================================================
:zeek:type:`Analyzer::disabling_analyzer`: :zeek:type:`hook` :zeek:attr:`&redef` A hook taking a connection, analyzer tag and analyzer id that can be
                                                                                 used to veto disabling protocol analyzers.
:zeek:type:`AnalyzerConfirmationInfo`: :zeek:type:`record`                       Generic analyzer confirmation info record.
:zeek:type:`AnalyzerViolationInfo`: :zeek:type:`record`                          Generic analyzer violation info record.
:zeek:type:`Backtrace`: :zeek:type:`vector`                                      A representation of a Zeek script's call stack.
:zeek:type:`BacktraceElement`: :zeek:type:`record`                               A representation of an element in a Zeek script's call stack.
:zeek:type:`BrokerPeeringStats`: :zeek:type:`record`                             Broker statistics for an individual peering.
:zeek:type:`BrokerPeeringStatsTable`: :zeek:type:`table`
:zeek:type:`BrokerStats`: :zeek:type:`record`                                    Statistics about Broker communication.
:zeek:type:`Cluster::Pool`: :zeek:type:`record`                                  A pool used for distributing data/work among a set of cluster nodes.
:zeek:type:`Cluster::PublishOnChangeAttr`: :zeek:type:`record`                   The record type used for the :zeek:attr:`&publish_on_change` attribute.
:zeek:type:`Cluster::TableChangeHeader`: :zeek:type:`record`                     Record passed as "header" into the :zeek:see:`Cluster::table_change_infos`
                                                                                 event that holds common information applying to all of the individual
                                                                                 :zeek:see:`Cluster::TableChangeInfo` records.
:zeek:type:`Cluster::TableChangeInfo`: :zeek:type:`record`                       Record encapsulating a single table change / modification for
                                                                                 distribution to other Zeek processes in a cluster.
:zeek:type:`Cluster::TableChangeInfos`: :zeek:type:`vector`                      Vector of individual :zeek:see:`Cluster::TableChangeInfo` records.
:zeek:type:`ConnStats`: :zeek:type:`record`
:zeek:type:`DHCP::Addrs`: :zeek:type:`vector`                                    A list of addresses offered by a DHCP server.
:zeek:type:`DHCP::ClientFQDN`: :zeek:type:`record`                               DHCP Client FQDN Option information (Option 81)
:zeek:type:`DHCP::ClientID`: :zeek:type:`record`                                 DHCP Client Identifier (Option 61)
:zeek:type:`DHCP::Msg`: :zeek:type:`record`                                      A DHCP message.
:zeek:type:`DHCP::Options`: :zeek:type:`record`
:zeek:type:`DHCP::SubOpt`: :zeek:type:`record`                                   DHCP Relay Agent Information Option (Option 82)
:zeek:type:`DHCP::SubOpts`: :zeek:type:`vector`
:zeek:type:`DNSStats`: :zeek:type:`record`                                       Statistics related to Zeek's active use of DNS.
:zeek:type:`EncapsulatingConnVector`: :zeek:type:`vector`                        A type alias for a vector of encapsulating "connections", i.e.
:zeek:type:`EventMetadata::Entry`: :zeek:type:`record`                           A event metadata entry.
:zeek:type:`EventMetadata::ID`: :zeek:type:`enum`                                Enum type for metadata identifiers.
:zeek:type:`EventNameCounter`: :zeek:type:`record` :zeek:attr:`&log`             Statistics about how many times each event name is queued.
:zeek:type:`EventNameStats`: :zeek:type:`vector`
:zeek:type:`EventStats`: :zeek:type:`record`
:zeek:type:`FileAnalysisStats`: :zeek:type:`record`                              Statistics of file analysis.
:zeek:type:`GapStats`: :zeek:type:`record`                                       Statistics about number of gaps in TCP connections.
:zeek:type:`IPAddrAnonymization`: :zeek:type:`enum`                              ..
:zeek:type:`IPAddrAnonymizationClass`: :zeek:type:`enum`                         ..
:zeek:type:`JSON::StringEscapePolicy`: :zeek:type:`enum`                         Escaping policy for non-printable non-UTF8 sequences.
:zeek:type:`JSON::TimestampFormat`: :zeek:type:`enum`
:zeek:type:`KRB::AP_Options`: :zeek:type:`record`                                AP Options.
:zeek:type:`KRB::Encrypted_Data`: :zeek:type:`record`
:zeek:type:`KRB::Error_Msg`: :zeek:type:`record`                                 The data from the ERROR_MSG message.
:zeek:type:`KRB::Host_Address`: :zeek:type:`record`                              A Kerberos host address See :rfc:`4120`.
:zeek:type:`KRB::Host_Address_Vector`: :zeek:type:`vector`
:zeek:type:`KRB::KDC_Options`: :zeek:type:`record`                               KDC Options.
:zeek:type:`KRB::KDC_Request`: :zeek:type:`record`                               The data from the AS_REQ and TGS_REQ messages.
:zeek:type:`KRB::KDC_Response`: :zeek:type:`record`                              The data from the AS_REQ and TGS_REQ messages.
:zeek:type:`KRB::SAFE_Msg`: :zeek:type:`record`                                  The data from the SAFE message.
:zeek:type:`KRB::Ticket`: :zeek:type:`record`                                    A Kerberos ticket.
:zeek:type:`KRB::Ticket_Vector`: :zeek:type:`vector`
:zeek:type:`KRB::Type_Value`: :zeek:type:`record`                                Used in a few places in the Kerberos analyzer for elements
                                                                                 that have a type and a string value.
:zeek:type:`KRB::Type_Value_Vector`: :zeek:type:`vector`
:zeek:type:`MOUNT3::dirmntargs_t`: :zeek:type:`record`                           MOUNT *mnt* arguments.
:zeek:type:`MOUNT3::info_t`: :zeek:type:`record`                                 Record summarizing the general results and status of MOUNT3
                                                                                 request/reply pairs.
:zeek:type:`MOUNT3::mnt_reply_t`: :zeek:type:`record`                            MOUNT lookup reply.
:zeek:type:`MQTT::ConnectAckMsg`: :zeek:type:`record`
:zeek:type:`MQTT::ConnectMsg`: :zeek:type:`record`
:zeek:type:`MQTT::PublishMsg`: :zeek:type:`record`
:zeek:type:`MatcherStats`: :zeek:type:`record`                                   Statistics of all regular expression matchers.
:zeek:type:`ModbusCoils`: :zeek:type:`vector`                                    A vector of boolean values that indicate the setting
                                                                                 for a range of modbus coils.
:zeek:type:`ModbusFileRecordRequest`: :zeek:type:`record`
:zeek:type:`ModbusFileRecordRequests`: :zeek:type:`vector`
:zeek:type:`ModbusFileRecordResponse`: :zeek:type:`record`
:zeek:type:`ModbusFileRecordResponses`: :zeek:type:`vector`
:zeek:type:`ModbusFileReference`: :zeek:type:`record`
:zeek:type:`ModbusFileReferences`: :zeek:type:`vector`
:zeek:type:`ModbusHeaders`: :zeek:type:`record`
:zeek:type:`ModbusRegisters`: :zeek:type:`vector`                                A vector of count values that represent 16bit modbus
                                                                                 register values.
:zeek:type:`NFS3::delobj_reply_t`: :zeek:type:`record`                           NFS reply for *remove*, *rmdir*.
:zeek:type:`NFS3::direntry_t`: :zeek:type:`record`                               NFS *direntry*.
:zeek:type:`NFS3::direntry_vec_t`: :zeek:type:`vector`                           Vector of NFS *direntry*.
:zeek:type:`NFS3::diropargs_t`: :zeek:type:`record`                              NFS *readdir* arguments.
:zeek:type:`NFS3::fattr_t`: :zeek:type:`record`                                  NFS file attributes.
:zeek:type:`NFS3::fsstat_t`: :zeek:type:`record`                                 NFS *fsstat*.
:zeek:type:`NFS3::info_t`: :zeek:type:`record`                                   Record summarizing the general results and status of NFSv3
                                                                                 request/reply pairs.
:zeek:type:`NFS3::link_reply_t`: :zeek:type:`record`                             NFS *link* reply.
:zeek:type:`NFS3::linkargs_t`: :zeek:type:`record`                               NFS *link* arguments.
:zeek:type:`NFS3::lookup_reply_t`: :zeek:type:`record`                           NFS lookup reply.
:zeek:type:`NFS3::newobj_reply_t`: :zeek:type:`record`                           NFS reply for *create*, *mkdir*, and *symlink*.
:zeek:type:`NFS3::read_reply_t`: :zeek:type:`record`                             NFS *read* reply.
:zeek:type:`NFS3::readargs_t`: :zeek:type:`record`                               NFS *read* arguments.
:zeek:type:`NFS3::readdir_reply_t`: :zeek:type:`record`                          NFS *readdir* reply.
:zeek:type:`NFS3::readdirargs_t`: :zeek:type:`record`                            NFS *readdir* arguments.
:zeek:type:`NFS3::readlink_reply_t`: :zeek:type:`record`                         NFS *readline* reply.
:zeek:type:`NFS3::renameobj_reply_t`: :zeek:type:`record`                        NFS reply for *rename*.
:zeek:type:`NFS3::renameopargs_t`: :zeek:type:`record`                           NFS *rename* arguments.
:zeek:type:`NFS3::sattr_reply_t`: :zeek:type:`record`                            NFS *sattr* reply.
:zeek:type:`NFS3::sattr_t`: :zeek:type:`record`                                  NFS file attributes.
:zeek:type:`NFS3::sattrargs_t`: :zeek:type:`record`                              NFS *sattr* arguments.
:zeek:type:`NFS3::symlinkargs_t`: :zeek:type:`record`                            NFS *symlink* arguments.
:zeek:type:`NFS3::symlinkdata_t`: :zeek:type:`record`                            NFS symlinkdata attributes.
:zeek:type:`NFS3::wcc_attr_t`: :zeek:type:`record`                               NFS *wcc* attributes.
:zeek:type:`NFS3::write_reply_t`: :zeek:type:`record`                            NFS *write* reply.
:zeek:type:`NFS3::writeargs_t`: :zeek:type:`record`                              NFS *write* arguments.
:zeek:type:`NTLM::AVs`: :zeek:type:`record`
:zeek:type:`NTLM::Authenticate`: :zeek:type:`record`
:zeek:type:`NTLM::Challenge`: :zeek:type:`record`
:zeek:type:`NTLM::Negotiate`: :zeek:type:`record`
:zeek:type:`NTLM::NegotiateFlags`: :zeek:type:`record`
:zeek:type:`NTLM::Version`: :zeek:type:`record`
:zeek:type:`NTP::ControlMessage`: :zeek:type:`record`                            NTP control message as defined in :rfc:`1119` for mode=6
                                                                                 This record contains the fields used by the NTP protocol
                                                                                 for control operations.
:zeek:type:`NTP::Message`: :zeek:type:`record`                                   NTP message as defined in :rfc:`5905`.
:zeek:type:`NTP::Mode7Message`: :zeek:type:`record`                              NTP mode 7 message.
:zeek:type:`NTP::StandardMessage`: :zeek:type:`record`                           NTP standard message as defined in :rfc:`5905` for modes 1-5
                                                                                 This record contains the standard fields used by the NTP protocol
                                                                                 for standard synchronization operations.
:zeek:type:`NetStats`: :zeek:type:`record`                                       Packet capture statistics.
:zeek:type:`PE::DOSHeader`: :zeek:type:`record`
:zeek:type:`PE::FileHeader`: :zeek:type:`record`
:zeek:type:`PE::OptionalHeader`: :zeek:type:`record`
:zeek:type:`PE::SectionHeader`: :zeek:type:`record`                              Record for Portable Executable (PE) section headers.
:zeek:type:`PacketSource`: :zeek:type:`record`                                   Properties of an I/O packet source being read by Zeek.
:zeek:type:`Pcap::Interface`: :zeek:type:`record`                                The definition of a "pcap interface".
:zeek:type:`Pcap::Interfaces`: :zeek:type:`set`
:zeek:type:`Pcap::filter_state`: :zeek:type:`enum`                               The state of the compilation for a pcap filter.
:zeek:type:`PcapFilterID`: :zeek:type:`enum`                                     Enum type identifying dynamic BPF filters.
:zeek:type:`PluginComponent`: :zeek:type:`record`                                Record containing information about a tag.
:zeek:type:`ProcStats`: :zeek:type:`record`                                      Statistics about Zeek's process.
:zeek:type:`RADIUS::AttributeList`: :zeek:type:`vector`
:zeek:type:`RADIUS::Attributes`: :zeek:type:`table`
:zeek:type:`RADIUS::Message`: :zeek:type:`record`
:zeek:type:`RDP::ClientChannelDef`: :zeek:type:`record`                          Name and flags for a single channel requested by the client.
:zeek:type:`RDP::ClientChannelList`: :zeek:type:`vector`                         The list of channels requested by the client.
:zeek:type:`RDP::ClientClusterData`: :zeek:type:`record`                         The TS_UD_CS_CLUSTER data block is sent by the client to the server
                                                                                 either to advertise that it can support the Server Redirection PDUs
                                                                                 or to request a connection to a given session identifier.
:zeek:type:`RDP::ClientCoreData`: :zeek:type:`record`
:zeek:type:`RDP::ClientSecurityData`: :zeek:type:`record`                        The TS_UD_CS_SEC data block contains security-related information used
                                                                                 to advertise client cryptographic support.
:zeek:type:`RDP::EarlyCapabilityFlags`: :zeek:type:`record`
:zeek:type:`ReassemblerStats`: :zeek:type:`record`                               Holds statistics for all types of reassembly.
:zeek:type:`ReporterStats`: :zeek:type:`record`                                  Statistics about reporter messages and weirds.
:zeek:type:`SMB1::Find_First2_Request_Args`: :zeek:type:`record`
:zeek:type:`SMB1::Find_First2_Response_Args`: :zeek:type:`record`
:zeek:type:`SMB1::Header`: :zeek:type:`record`                                   An SMB1 header.
:zeek:type:`SMB1::NegotiateCapabilities`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateRawMode`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateResponse`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateResponseCore`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateResponseLANMAN`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateResponseNTLM`: :zeek:type:`record`
:zeek:type:`SMB1::NegotiateResponseSecurity`: :zeek:type:`record`
:zeek:type:`SMB1::SessionSetupAndXCapabilities`: :zeek:type:`record`
:zeek:type:`SMB1::SessionSetupAndXRequest`: :zeek:type:`record`
:zeek:type:`SMB1::SessionSetupAndXResponse`: :zeek:type:`record`
:zeek:type:`SMB1::Trans2_Args`: :zeek:type:`record`
:zeek:type:`SMB1::Trans2_Sec_Args`: :zeek:type:`record`
:zeek:type:`SMB1::Trans_Sec_Args`: :zeek:type:`record`
:zeek:type:`SMB2::CloseResponse`: :zeek:type:`record`                            The response to an SMB2 *close* request, which is used by the client to close an instance
                                                                                 of a file that was opened previously.
:zeek:type:`SMB2::CompressionCapabilities`: :zeek:type:`record`                  Compression information as defined in SMB v.
:zeek:type:`SMB2::CreateRequest`: :zeek:type:`record`                            The request sent by the client to request either creation of or access to a file.
:zeek:type:`SMB2::CreateResponse`: :zeek:type:`record`                           The response to an SMB2 *create_request* request, which is sent by the client to request
                                                                                 either creation of or access to a file.
:zeek:type:`SMB2::EncryptionCapabilities`: :zeek:type:`record`                   Encryption information as defined in SMB v.
:zeek:type:`SMB2::FileAttrs`: :zeek:type:`record`                                A series of boolean flags describing basic and extended file attributes for SMB2.
:zeek:type:`SMB2::FileEA`: :zeek:type:`record`                                   This information class is used to query or set extended attribute (EA) information for a file.
:zeek:type:`SMB2::FileEAs`: :zeek:type:`vector`                                  A vector of extended attribute (EA) information for a file.
:zeek:type:`SMB2::Fscontrol`: :zeek:type:`record`                                A series of integers flags used to set quota and content indexing control information for a file system volume in SMB2.
:zeek:type:`SMB2::GUID`: :zeek:type:`record`                                     An SMB2 globally unique identifier which identifies a file.
:zeek:type:`SMB2::Header`: :zeek:type:`record`                                   An SMB2 header.
:zeek:type:`SMB2::NegotiateContextValue`: :zeek:type:`record`                    The context type information as defined in SMB v.
:zeek:type:`SMB2::NegotiateContextValues`: :zeek:type:`vector`
:zeek:type:`SMB2::NegotiateResponse`: :zeek:type:`record`                        The response to an SMB2 *negotiate* request, which is used by the client to notify the server
                                                                                 what dialects of the SMB2 protocol the client understands.
:zeek:type:`SMB2::PreAuthIntegrityCapabilities`: :zeek:type:`record`             Preauthentication information as defined in SMB v.
:zeek:type:`SMB2::SessionSetupFlags`: :zeek:type:`record`                        A flags field that indicates additional information about the session that's sent in the
                                                                                 *session_setup* response.
:zeek:type:`SMB2::SessionSetupRequest`: :zeek:type:`record`                      The request sent by the client to request a new authenticated session
                                                                                 within a new or existing SMB 2 Protocol transport connection to the server.
:zeek:type:`SMB2::SessionSetupResponse`: :zeek:type:`record`                     The response to an SMB2 *session_setup* request, which is sent by the client to request a
                                                                                 new authenticated session within a new or existing SMB 2 Protocol transport connection
                                                                                 to the server.
:zeek:type:`SMB2::Transform_header`: :zeek:type:`record`                         An SMB2 transform header (for SMB 3.x dialects with encryption enabled).
:zeek:type:`SMB2::TreeConnectResponse`: :zeek:type:`record`                      The response to an SMB2 *tree_connect* request, which is sent by the client to request
                                                                                 access to a particular share on the server.
:zeek:type:`SMB::MACTimes`: :zeek:type:`record`                                  MAC times for a file.
:zeek:type:`SNMP::Binding`: :zeek:type:`record`                                  The ``VarBind`` data structure from either :rfc:`1157` or
                                                                                 :rfc:`3416`, which maps an Object Identifier to a value.
:zeek:type:`SNMP::Bindings`: :zeek:type:`vector`                                 A ``VarBindList`` data structure from either :rfc:`1157` or :rfc:`3416`.
:zeek:type:`SNMP::BulkPDU`: :zeek:type:`record`                                  A ``BulkPDU`` data structure from :rfc:`3416`.
:zeek:type:`SNMP::Header`: :zeek:type:`record`                                   A generic SNMP header data structure that may include data from
                                                                                 any version of SNMP.
:zeek:type:`SNMP::HeaderV1`: :zeek:type:`record`                                 The top-level message data structure of an SNMPv1 datagram, not
                                                                                 including the PDU data.
:zeek:type:`SNMP::HeaderV2`: :zeek:type:`record`                                 The top-level message data structure of an SNMPv2 datagram, not
                                                                                 including the PDU data.
:zeek:type:`SNMP::HeaderV3`: :zeek:type:`record`                                 The top-level message data structure of an SNMPv3 datagram, not
                                                                                 including the PDU data.
:zeek:type:`SNMP::ObjectValue`: :zeek:type:`record`                              A generic SNMP object value, that may include any of the
                                                                                 valid ``ObjectSyntax`` values from :rfc:`1155` or :rfc:`3416`.
:zeek:type:`SNMP::PDU`: :zeek:type:`record`                                      A ``PDU`` data structure from either :rfc:`1157` or :rfc:`3416`.
:zeek:type:`SNMP::ScopedPDU_Context`: :zeek:type:`record`                        The ``ScopedPduData`` data structure of an SNMPv3 datagram, not
                                                                                 including the PDU data (i.e.
:zeek:type:`SNMP::TrapPDU`: :zeek:type:`record`                                  A ``Trap-PDU`` data structure from :rfc:`1157`.
:zeek:type:`SNMP::UserSecurityParameters`: :zeek:type:`record`                   The UserSecurityParaneters for SNMPv3 messages using the
                                                                                 User-based Security Model.
:zeek:type:`SOCKS::Address`: :zeek:type:`record` :zeek:attr:`&log`               This record is for a SOCKS client or server to provide either a
                                                                                 name or an address to represent a desired or established connection.
:zeek:type:`SSH::Algorithm_Prefs`: :zeek:type:`record`                           The client and server each have some preferences for the algorithms used
                                                                                 in each direction.
:zeek:type:`SSH::Capabilities`: :zeek:type:`record`                              This record lists the preferences of an SSH endpoint for
                                                                                 algorithm selection.
:zeek:type:`SSL::PSKIdentity`: :zeek:type:`record`
:zeek:type:`SSL::SignatureAndHashAlgorithm`: :zeek:type:`record`
:zeek:type:`SYN_packet`: :zeek:type:`record`                                     Fields of a SYN packet.
:zeek:type:`Storage::OperationResult`: :zeek:type:`record`                       Returned as the result of the various storage operations.
:zeek:type:`Storage::ReturnCode`: :zeek:type:`enum` :zeek:attr:`&redef`          Common set of statuses that can be returned by storage operations.
:zeek:type:`TCP::Option`: :zeek:type:`record`                                    A TCP Option field parsed from a TCP header.
:zeek:type:`TCP::OptionList`: :zeek:type:`vector`                                The full list of TCP Option fields parsed from a TCP header.
:zeek:type:`TCP::RawOption`: :zeek:type:`record`                                 A Raw TCP Option field from a TCP header
:zeek:type:`TCP::RawOptionList`: :zeek:type:`vector`                             The full list of TCP option fields in a TCP header.
:zeek:type:`Telemetry::HistogramMetric`: :zeek:type:`record`                     Histograms returned by the :zeek:see:`Telemetry::collect_histogram_metrics` function.
:zeek:type:`Telemetry::HistogramMetricVector`: :zeek:type:`vector`
:zeek:type:`Telemetry::Metric`: :zeek:type:`record`                              Metrics returned by the :zeek:see:`Telemetry::collect_metrics` function.
:zeek:type:`Telemetry::MetricOpts`: :zeek:type:`record`                          Type that captures options used to create metrics.
:zeek:type:`Telemetry::MetricVector`: :zeek:type:`vector`
:zeek:type:`ThreadStats`: :zeek:type:`record`                                    Statistics about threads.
:zeek:type:`TimerStats`: :zeek:type:`record`                                     Statistics of timers.
:zeek:type:`Tunnel::EncapsulatingConn`: :zeek:type:`record` :zeek:attr:`&log`    Records the identity of an encapsulating parent of a tunneled connection.
:zeek:type:`WebSocket::AnalyzerConfig`: :zeek:type:`record`                      Record type that is passed to :zeek:see:`WebSocket::configure_analyzer`.
:zeek:type:`X509::BasicConstraints`: :zeek:type:`record` :zeek:attr:`&log`
:zeek:type:`X509::Certificate`: :zeek:type:`record`
:zeek:type:`X509::Extension`: :zeek:type:`record`
:zeek:type:`X509::Result`: :zeek:type:`record`                                   Result of an X509 certificate chain verification
:zeek:type:`X509::SubjectAlternativeName`: :zeek:type:`record`
:zeek:type:`ZAM::Prof::Profile`: :zeek:type:`record`                             Summarizes ZAM profiling information for a given module.
:zeek:type:`addr_set`: :zeek:type:`set`                                          A set of addresses.
:zeek:type:`addr_vec`: :zeek:type:`vector`                                       A vector of addresses.
:zeek:type:`any_vec`: :zeek:type:`vector`                                        A vector of any, used by some builtin functions to store a list of varying
                                                                                 types.
:zeek:type:`assertion_failure`: :zeek:type:`hook`                                A hook that is invoked when an assert statement fails.
:zeek:type:`assertion_result`: :zeek:type:`hook`                                 A hook that is invoked with the result of every assert statement.
:zeek:type:`bittorrent_benc_dir`: :zeek:type:`table`                             A table of BitTorrent "benc" values.
:zeek:type:`bittorrent_benc_value`: :zeek:type:`record`                          BitTorrent "benc" value.
:zeek:type:`bittorrent_peer`: :zeek:type:`record`                                A BitTorrent peer.
:zeek:type:`bittorrent_peer_set`: :zeek:type:`set`                               A set of BitTorrent peers.
:zeek:type:`bt_tracker_headers`: :zeek:type:`table`                              Header table type used by BitTorrent analyzer.
:zeek:type:`call_argument`: :zeek:type:`record`                                  Meta-information about a parameter to a function/event.
:zeek:type:`call_argument_vector`: :zeek:type:`vector`                           Vector type used to capture parameters of a function/event call.
:zeek:type:`conn_id`: :zeek:type:`record`                                        A connection's identifying 4-tuple of endpoints and ports.
:zeek:type:`conn_id_ctx`: :zeek:type:`record`                                    A record type containing the context of a conn_id instance.
:zeek:type:`connection`: :zeek:type:`record`                                     A connection.
:zeek:type:`connection_timing_out`: :zeek:type:`hook`                            A hook that can be used to veto timing out a connection via :zeek:see:`break`.
:zeek:type:`count_set`: :zeek:type:`set`                                         A set of counts.
:zeek:type:`dns_answer`: :zeek:type:`record`                                     The general part of a DNS reply.
:zeek:type:`dns_binds_rr`: :zeek:type:`record`                                   A Private RR type BINDS record.
:zeek:type:`dns_dnskey_rr`: :zeek:type:`record`                                  A DNSSEC DNSKEY record.
:zeek:type:`dns_ds_rr`: :zeek:type:`record`                                      A DNSSEC DS record.
:zeek:type:`dns_edns_additional`: :zeek:type:`record`                            An additional DNS EDNS record.
:zeek:type:`dns_edns_cookie`: :zeek:type:`record`                                An DNS EDNS COOKIE (COOKIE) record.
:zeek:type:`dns_edns_ecs`: :zeek:type:`record`                                   An DNS EDNS Client Subnet (ECS) record.
:zeek:type:`dns_edns_tcp_keepalive`: :zeek:type:`record`                         An DNS EDNS TCP KEEPALIVE (TCP KEEPALIVE) record.
:zeek:type:`dns_loc_rr`: :zeek:type:`record`                                     A Private RR type LOC record.
:zeek:type:`dns_mapping`: :zeek:type:`record`
:zeek:type:`dns_msg`: :zeek:type:`record`                                        A DNS message.
:zeek:type:`dns_naptr_rr`: :zeek:type:`record`                                   A NAPTR record.
:zeek:type:`dns_nsec3_rr`: :zeek:type:`record`                                   A DNSSEC NSEC3 record.
:zeek:type:`dns_nsec3param_rr`: :zeek:type:`record`                              A DNSSEC NSEC3PARAM record.
:zeek:type:`dns_rrsig_rr`: :zeek:type:`record`                                   A DNSSEC RRSIG record.
:zeek:type:`dns_soa`: :zeek:type:`record`                                        A DNS SOA record.
:zeek:type:`dns_svcb_param`: :zeek:type:`record`                                 A SvcParamKey with an optional SvcParamValue.
:zeek:type:`dns_svcb_param_vec`: :zeek:type:`vector`
:zeek:type:`dns_svcb_rr`: :zeek:type:`record`                                    A SVCB or HTTPS record.
:zeek:type:`dns_tkey`: :zeek:type:`record`                                       A DNS TKEY record.
:zeek:type:`dns_tsig_additional`: :zeek:type:`record`                            An additional DNS TSIG record.
:zeek:type:`double_vec`: :zeek:type:`vector`                                     A vector of floating point numbers, used by telemetry builtin functions to store histogram bounds.
:zeek:type:`endpoint`: :zeek:type:`record`                                       Statistics about a :zeek:type:`connection` endpoint.
:zeek:type:`endpoint_stats`: :zeek:type:`record`                                 Statistics about what a TCP endpoint sent.
:zeek:type:`entropy_test_result`: :zeek:type:`record`                            Computed entropy values.
:zeek:type:`event_metadata_vec`: :zeek:type:`vector`                             A type alias for event metadata.
:zeek:type:`fa_file`: :zeek:type:`record` :zeek:attr:`&redef`                    File Analysis handle for a file that Zeek is analyzing.
:zeek:type:`fa_metadata`: :zeek:type:`record`                                    File Analysis metadata that's been inferred about a particular file.
:zeek:type:`files_tag_set`: :zeek:type:`set`                                     A set of file analyzer tags.
:zeek:type:`flow_id`: :zeek:type:`record` :zeek:attr:`&log`                      The identifying 4-tuple of a uni-directional flow.
:zeek:type:`from_json_result`: :zeek:type:`record`                               Return type for from_json BIF.
:zeek:type:`ftp_port`: :zeek:type:`record`                                       A parsed host/port combination describing server endpoint for an upcoming
                                                                                 data transfer.
:zeek:type:`geo_autonomous_system`: :zeek:type:`record` :zeek:attr:`&log`        GeoIP autonomous system information.
:zeek:type:`geo_location`: :zeek:type:`record` :zeek:attr:`&log`                 GeoIP location information.
:zeek:type:`gtp_access_point_name`: :zeek:type:`string`
:zeek:type:`gtp_cause`: :zeek:type:`count`
:zeek:type:`gtp_charging_characteristics`: :zeek:type:`count`
:zeek:type:`gtp_charging_gateway_addr`: :zeek:type:`addr`
:zeek:type:`gtp_charging_id`: :zeek:type:`count`
:zeek:type:`gtp_create_pdp_ctx_request_elements`: :zeek:type:`record`
:zeek:type:`gtp_create_pdp_ctx_response_elements`: :zeek:type:`record`
:zeek:type:`gtp_delete_pdp_ctx_request_elements`: :zeek:type:`record`
:zeek:type:`gtp_delete_pdp_ctx_response_elements`: :zeek:type:`record`
:zeek:type:`gtp_end_user_addr`: :zeek:type:`record`
:zeek:type:`gtp_gsn_addr`: :zeek:type:`record`
:zeek:type:`gtp_imsi`: :zeek:type:`count`
:zeek:type:`gtp_msisdn`: :zeek:type:`string`
:zeek:type:`gtp_nsapi`: :zeek:type:`count`
:zeek:type:`gtp_omc_id`: :zeek:type:`string`
:zeek:type:`gtp_private_extension`: :zeek:type:`record`
:zeek:type:`gtp_proto_config_options`: :zeek:type:`string`
:zeek:type:`gtp_qos_profile`: :zeek:type:`record`
:zeek:type:`gtp_rai`: :zeek:type:`record`
:zeek:type:`gtp_recovery`: :zeek:type:`count`
:zeek:type:`gtp_reordering_required`: :zeek:type:`bool`
:zeek:type:`gtp_selection_mode`: :zeek:type:`count`
:zeek:type:`gtp_teardown_ind`: :zeek:type:`bool`
:zeek:type:`gtp_teid1`: :zeek:type:`count`
:zeek:type:`gtp_teid_control_plane`: :zeek:type:`count`
:zeek:type:`gtp_tft`: :zeek:type:`string`
:zeek:type:`gtp_trace_reference`: :zeek:type:`count`
:zeek:type:`gtp_trace_type`: :zeek:type:`count`
:zeek:type:`gtp_trigger_id`: :zeek:type:`string`
:zeek:type:`gtp_update_pdp_ctx_request_elements`: :zeek:type:`record`
:zeek:type:`gtp_update_pdp_ctx_response_elements`: :zeek:type:`record`
:zeek:type:`gtpv1_hdr`: :zeek:type:`record`                                      A GTPv1 (GPRS Tunneling Protocol) header.
:zeek:type:`http_message_stat`: :zeek:type:`record`                              HTTP message statistics.
:zeek:type:`http_stats_rec`: :zeek:type:`record`                                 HTTP session statistics.
:zeek:type:`icmp6_mldv2_group_type`: :zeek:type:`enum`                           ICMPv6 MLD Version 2 Multicast Address Record types, as defined in
                                                                                 :rfc:`3810#section-5.2.12`
:zeek:type:`icmp6_mldv2_mar`: :zeek:type:`record`                                ICMPv6 MLD Version 2 Multicast Address Record, as defined in
                                                                                 :rfc:`3810#section-5.2`
:zeek:type:`icmp6_mldv2_mar_vec`: :zeek:type:`vector`
:zeek:type:`icmp6_nd_option`: :zeek:type:`record`                                Options extracted from ICMPv6 neighbor discovery messages as specified
                                                                                 by :rfc:`4861`.
:zeek:type:`icmp6_nd_options`: :zeek:type:`vector`                               A type alias for a vector of ICMPv6 neighbor discovery message options.
:zeek:type:`icmp6_nd_prefix_info`: :zeek:type:`record`                           Values extracted from a Prefix Information option in an ICMPv6 neighbor
                                                                                 discovery message as specified by :rfc:`4861`.
:zeek:type:`icmp_context`: :zeek:type:`record`                                   Packet context part of an ICMP message.
:zeek:type:`icmp_hdr`: :zeek:type:`record`                                       Values extracted from an ICMP header.
:zeek:type:`icmp_info`: :zeek:type:`record`                                      Specifics about an ICMP conversation/packet.
:zeek:type:`id_table`: :zeek:type:`table`                                        Table type used to map script-level identifiers to meta-information
                                                                                 describing them.
:zeek:type:`index_vec`: :zeek:type:`vector`                                      A vector of counts, used by some builtin functions to store a list of indices.
:zeek:type:`int_vec`: :zeek:type:`vector`                                        A vector of integers, used by telemetry builtin functions to store histogram bounds.
:zeek:type:`interval_set`: :zeek:type:`set`                                      A set of intervals.
:zeek:type:`ip4_hdr`: :zeek:type:`record`                                        Values extracted from an IPv4 header.
:zeek:type:`ip6_ah`: :zeek:type:`record`                                         Values extracted from an IPv6 Authentication extension header.
:zeek:type:`ip6_dstopts`: :zeek:type:`record`                                    Values extracted from an IPv6 Destination options extension header.
:zeek:type:`ip6_esp`: :zeek:type:`record`                                        Values extracted from an IPv6 ESP extension header.
:zeek:type:`ip6_ext_hdr`: :zeek:type:`record`                                    A general container for a more specific IPv6 extension header.
:zeek:type:`ip6_ext_hdr_chain`: :zeek:type:`vector`                              A type alias for a vector of IPv6 extension headers.
:zeek:type:`ip6_fragment`: :zeek:type:`record`                                   Values extracted from an IPv6 Fragment extension header.
:zeek:type:`ip6_hdr`: :zeek:type:`record`                                        Values extracted from an IPv6 header.
:zeek:type:`ip6_hopopts`: :zeek:type:`record`                                    Values extracted from an IPv6 Hop-by-Hop options extension header.
:zeek:type:`ip6_mobility_back`: :zeek:type:`record`                              Values extracted from an IPv6 Mobility Binding Acknowledgement message.
:zeek:type:`ip6_mobility_be`: :zeek:type:`record`                                Values extracted from an IPv6 Mobility Binding Error message.
:zeek:type:`ip6_mobility_brr`: :zeek:type:`record`                               Values extracted from an IPv6 Mobility Binding Refresh Request message.
:zeek:type:`ip6_mobility_bu`: :zeek:type:`record`                                Values extracted from an IPv6 Mobility Binding Update message.
:zeek:type:`ip6_mobility_cot`: :zeek:type:`record`                               Values extracted from an IPv6 Mobility Care-of Test message.
:zeek:type:`ip6_mobility_coti`: :zeek:type:`record`                              Values extracted from an IPv6 Mobility Care-of Test Init message.
:zeek:type:`ip6_mobility_hdr`: :zeek:type:`record`                               Values extracted from an IPv6 Mobility header.
:zeek:type:`ip6_mobility_hot`: :zeek:type:`record`                               Values extracted from an IPv6 Mobility Home Test message.
:zeek:type:`ip6_mobility_hoti`: :zeek:type:`record`                              Values extracted from an IPv6 Mobility Home Test Init message.
:zeek:type:`ip6_mobility_msg`: :zeek:type:`record`                               Values extracted from an IPv6 Mobility header's message data.
:zeek:type:`ip6_option`: :zeek:type:`record`                                     Values extracted from an IPv6 extension header's (e.g.
:zeek:type:`ip6_options`: :zeek:type:`vector`                                    A type alias for a vector of IPv6 options.
:zeek:type:`ip6_routing`: :zeek:type:`record`                                    Values extracted from an IPv6 Routing extension header.
:zeek:type:`irc_join_info`: :zeek:type:`record`                                  IRC join information.
:zeek:type:`irc_join_list`: :zeek:type:`set`                                     Set of IRC join information.
:zeek:type:`l2_hdr`: :zeek:type:`record`                                         Values extracted from the layer 2 header.
:zeek:type:`mime_header_list`: :zeek:type:`table`                                A list of MIME headers.
:zeek:type:`mime_header_rec`: :zeek:type:`record`                                A MIME header key/value pair.
:zeek:type:`mime_match`: :zeek:type:`record`                                     A structure indicating a MIME type and strength of a match against
                                                                                 file magic signatures.
:zeek:type:`mime_matches`: :zeek:type:`vector`                                   A vector of file magic signature matches, ordered by strength of
                                                                                 the signature, strongest first.
:zeek:type:`pcap_packet`: :zeek:type:`record`                                    Policy-level representation of a packet passed on by libpcap.
:zeek:type:`pkt_hdr`: :zeek:type:`record`                                        A packet header, consisting of an IP header and transport-layer header.
:zeek:type:`pkt_profile_modes`: :zeek:type:`enum`                                Output modes for packet profiling information.
:zeek:type:`plugin_component_vec`: :zeek:type:`vector`
:zeek:type:`pm_callit_request`: :zeek:type:`record`                              An RPC portmapper *callit* request.
:zeek:type:`pm_mapping`: :zeek:type:`record`                                     An RPC portmapper mapping.
:zeek:type:`pm_mappings`: :zeek:type:`table`                                     Table of RPC portmapper mappings.
:zeek:type:`pm_port_request`: :zeek:type:`record`                                An RPC portmapper request.
:zeek:type:`psk_identity_vec`: :zeek:type:`vector`
:zeek:type:`raw_pkt_hdr`: :zeek:type:`record`                                    A raw packet header, consisting of L2 header and everything in
                                                                                 :zeek:see:`pkt_hdr`.
:zeek:type:`record_field`: :zeek:type:`record`                                   Meta-information about a record field.
:zeek:type:`record_field_table`: :zeek:type:`table`                              Table type used to map record field declarations to meta-information
                                                                                 describing them.
:zeek:type:`rotate_info`: :zeek:type:`record`                                    ..
:zeek:type:`script_id`: :zeek:type:`record`                                      Meta-information about a script-level identifier.
:zeek:type:`script_id_attr`: :zeek:type:`record`                                 Meta-information about script-level attribute.
:zeek:type:`script_id_attrs`: :zeek:type:`vector`
:zeek:type:`signature_and_hashalgorithm_vec`: :zeek:type:`vector`                A vector of Signature and Hash Algorithms.
:zeek:type:`signature_state`: :zeek:type:`record`                                Description of a signature match.
:zeek:type:`string_any_file_hook`: :zeek:type:`hook`                             A hook taking a fa_file, an any, and a string.
:zeek:type:`string_any_table`: :zeek:type:`table`                                A string-table of any.
:zeek:type:`string_array`: :zeek:type:`table`                                    An ordered array of strings.
:zeek:type:`string_mapper`: :zeek:type:`function`                                Function mapping a string to a string.
:zeek:type:`string_set`: :zeek:type:`set`                                        A set of strings.
:zeek:type:`string_vec`: :zeek:type:`vector`                                     A vector of strings.
:zeek:type:`subnet_set`: :zeek:type:`set`                                        A set of subnets.
:zeek:type:`subnet_vec`: :zeek:type:`vector`                                     A vector of subnets.
:zeek:type:`sw_align`: :zeek:type:`record`                                       Helper type for return value of Smith-Waterman algorithm.
:zeek:type:`sw_align_vec`: :zeek:type:`vector`                                   Helper type for return value of Smith-Waterman algorithm.
:zeek:type:`sw_params`: :zeek:type:`record`                                      Parameters for the Smith-Waterman algorithm.
:zeek:type:`sw_substring`: :zeek:type:`record`                                   Helper type for return value of Smith-Waterman algorithm.
:zeek:type:`sw_substring_vec`: :zeek:type:`vector`                               Return type for Smith-Waterman algorithm.
:zeek:type:`table_string_of_count`: :zeek:type:`table`                           A table of counts indexed by strings.
:zeek:type:`table_string_of_string`: :zeek:type:`table`                          A table of strings indexed by strings.
:zeek:type:`tcp_hdr`: :zeek:type:`record`                                        Values extracted from a TCP header.
:zeek:type:`teredo_auth`: :zeek:type:`record`                                    A Teredo origin indication header.
:zeek:type:`teredo_hdr`: :zeek:type:`record`                                     A Teredo packet header.
:zeek:type:`teredo_origin`: :zeek:type:`record`                                  A Teredo authentication header.
:zeek:type:`transport_proto`: :zeek:type:`enum`                                  A connection's transport-layer protocol.
:zeek:type:`udp_hdr`: :zeek:type:`record`                                        Values extracted from a UDP header.
:zeek:type:`var_sizes`: :zeek:type:`table`                                       Table type used to map variable names to their memory allocation.
:zeek:type:`x509_opaque_vector`: :zeek:type:`vector`                             A vector of x509 opaques.
:zeek:type:`ConnKey::Tag`: :zeek:type:`enum`
================================================================================ =======================================================================================================================

Events
######
================================================================== =================================================================================
:zeek:id:`Cluster::forward_table_change_infos`: :zeek:type:`event` Internal helper event used by worker processes to delegate publishing
                                                                   to the Zeek manager when running under Broker.
:zeek:id:`Cluster::table_change_infos`: :zeek:type:`event`         Internal'ish event for propagating table changes via :zeek:see:`Cluster::publish`
                                                                   to other Zeek processes in a cluster.
================================================================== =================================================================================

Hooks
#####
====================================================================== ===============================================================
:zeek:id:`Cluster::apply_table_change_infos_policy`: :zeek:type:`hook` A hook for testing and intercepting changes to tables coming in
                                                                       via the &publish_on_change mechanism from other Zeek processes.
:zeek:id:`Telemetry::sync`: :zeek:type:`hook`                          Telemetry sync hook.
====================================================================== ===============================================================

Functions
#########
============================================================== =========================================================
:zeek:id:`add_interface`: :zeek:type:`function`                Internal function.
:zeek:id:`add_signature_file`: :zeek:type:`function`           Internal function.
:zeek:id:`discarder_check_icmp`: :zeek:type:`function`         Function for skipping packets based on their ICMP header.
:zeek:id:`discarder_check_ip`: :zeek:type:`function`           Function for skipping packets based on their IP header.
:zeek:id:`discarder_check_tcp`: :zeek:type:`function`          Function for skipping packets based on their TCP header.
:zeek:id:`discarder_check_udp`: :zeek:type:`function`          Function for skipping packets based on their UDP header.
:zeek:id:`from_json_default_key_mapper`: :zeek:type:`function` The default JSON key mapper function.
:zeek:id:`max_count`: :zeek:type:`function`                    Returns maximum of two ``count`` values.
:zeek:id:`max_double`: :zeek:type:`function`                   Returns maximum of two ``double`` values.
:zeek:id:`max_interval`: :zeek:type:`function`                 Returns maximum of two ``interval`` values.
:zeek:id:`min_count`: :zeek:type:`function`                    Returns minimum of two ``count`` values.
:zeek:id:`min_double`: :zeek:type:`function`                   Returns minimum of two ``double`` values.
:zeek:id:`min_interval`: :zeek:type:`function`                 Returns minimum of two ``interval`` values.
============================================================== =========================================================


Detailed Interface
~~~~~~~~~~~~~~~~~~
Runtime Options
###############
.. zeek:id:: Cluster::default_table_publish_on_change_max_batch_delay
   :source-code: base/init-bare.zeek 6327 6327

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 msecs``

   Default maximum delay size for the the :zeek:attr:`&publish_on_change` attribute.

.. zeek:id:: Cluster::default_table_publish_on_change_max_batch_size
   :source-code: base/init-bare.zeek 6324 6324

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   Default maximum batch size for the :zeek:attr:`&publish_on_change` attribute.

.. zeek:id:: Finger::max_line_length
   :source-code: base/init-bare.zeek 6302 6302

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1024``

   The maximum line length for Finger requests and replies. If any lines
   exceed this limit, then this will trigger a violation.

.. zeek:id:: MQTT::max_payload_size
   :source-code: base/init-bare.zeek 6282 6282

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum payload size to allocate for the purpose of
   payload information in :zeek:see:`mqtt_publish` events (and the
   default MQTT logs generated from that).

.. zeek:id:: Weird::sampling_duration
   :source-code: base/init-bare.zeek 6439 6439

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 mins``

   How long a weird of a given type is allowed to keep state/counters in
   memory. For "net" weirds an expiration timer starts per weird name when
   first initializing its counter. For "flow" weirds an expiration timer
   starts once per src/dst IP pair for the first weird of any name. For
   "conn" weirds, counters and expiration timers are kept for the duration
   of the connection for each named weird and reset when necessary. E.g.
   if a "conn" weird by the name of "foo" is seen more than
   :zeek:see:`Weird::sampling_threshold` times, then an expiration timer
   begins for "foo" and upon triggering will reset the counter for "foo"
   and unthrottle its rate-limiting until it once again exceeds the
   threshold.

.. zeek:id:: Weird::sampling_global_list
   :source-code: base/init-bare.zeek 6415 6415

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Rate-limits weird names in the table globally instead of per connection/flow.

.. zeek:id:: Weird::sampling_rate
   :source-code: base/init-bare.zeek 6426 6426

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   The rate-limiting sampling rate. One out of every of this number of
   rate-limited weirds of a given type will be allowed to raise events
   for further script-layer handling. Setting the sampling rate to 0
   will disable all output of rate-limited weirds.

.. zeek:id:: Weird::sampling_threshold
   :source-code: base/init-bare.zeek 6420 6420

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``25``

   How many weirds of a given type to tolerate before sampling begins.
   I.e. this many consecutive weirds of a given type will be allowed to
   raise events for script-layer handling before being rate-limited.

.. zeek:id:: Weird::sampling_whitelist
   :source-code: base/init-bare.zeek 6412 6412

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Prevents rate-limiting sampling of any weirds named in the table.

.. zeek:id:: default_file_bof_buffer_size
   :source-code: base/init-bare.zeek 1023 1023

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``4096``
   :Redefinition: from :doc:`/scripts/policy/frameworks/signatures/iso-9660.zeek`

      ``=``::

         2048 * (16 + 1)


   Default amount of bytes that file analysis will buffer in order to use
   for mime type matching.  File analyzers attached at the time of mime type
   matching or later, will receive a copy of this buffer.

.. zeek:id:: default_file_timeout_interval
   :source-code: base/init-bare.zeek 1018 1018

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``2.0 mins``

   Default amount of time a file can be inactive before the file analysis
   gives up and discards any internal state related to the file.

.. zeek:id:: ignore_checksums_nets
   :source-code: base/init-bare.zeek 1739 1739

   :Type: :zeek:type:`set` [:zeek:type:`subnet`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Checksums are ignored for all packets with a src address within this set of
   networks. Useful for cases where a host might be seeing packets collected
   from local hosts before checksums were applied by hardware. This frequently
   manifests when sniffing a local management interface on a host and Zeek sees
   packets before the hardware has had a chance to apply the checksums.

.. zeek:id:: udp_content_delivery_ports_use_resp
   :source-code: base/init-bare.zeek 1935 1935

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether ports given in :zeek:see:`udp_content_delivery_ports_orig`
   and :zeek:see:`udp_content_delivery_ports_resp` are in terms of
   UDP packet's destination port or the UDP connection's "responder"
   port.

.. zeek:id:: udp_content_ports
   :source-code: base/init-bare.zeek 1929 1929

   :Type: :zeek:type:`set` [:zeek:type:`port`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Defines UDP ports (source or destination) for which the contents of
   either originator or responder streams should be delivered via
   :zeek:see:`udp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp tcp_content_deliver_all_orig
      tcp_content_deliver_all_resp udp_content_delivery_ports_orig
      udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents
      udp_content_delivery_ports_use_resp udp_content_delivery_ports_resp

Redefinable Options
###################
.. zeek:id:: AF_Packet::block_size
   :source-code: base/init-bare.zeek 5994 5994

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``32768``

   Size of an individual block. Needs to be a multiple of page size.

.. zeek:id:: AF_Packet::block_timeout
   :source-code: base/init-bare.zeek 5996 5996

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 msecs``

   Retire timeout for a single block.

.. zeek:id:: AF_Packet::buffer_size
   :source-code: base/init-bare.zeek 5992 5992

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``134217728``

   Size of the ring-buffer.

.. zeek:id:: AF_Packet::checksum_validation_mode
   :source-code: base/init-bare.zeek 6010 6010

   :Type: :zeek:type:`AF_Packet::ChecksumMode`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``AF_Packet::CHECKSUM_ON``

   Checksum validation mode.

.. zeek:id:: AF_Packet::enable_defrag
   :source-code: base/init-bare.zeek 6002 6002

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Toggle defragmentation of IP packets using PACKET_FANOUT_FLAG_DEFRAG.

.. zeek:id:: AF_Packet::enable_fanout
   :source-code: base/init-bare.zeek 6000 6000

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Toggle whether to use PACKET_FANOUT.

.. zeek:id:: AF_Packet::enable_hw_timestamping
   :source-code: base/init-bare.zeek 5998 5998

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Toggle whether to use hardware timestamps.

.. zeek:id:: AF_Packet::fanout_id
   :source-code: base/init-bare.zeek 6006 6006

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``23``

   Fanout ID.

.. zeek:id:: AF_Packet::fanout_mode
   :source-code: base/init-bare.zeek 6004 6004

   :Type: :zeek:type:`AF_Packet::FanoutMode`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``AF_Packet::FANOUT_HASH``

   Fanout mode.

.. zeek:id:: AF_Packet::link_type
   :source-code: base/init-bare.zeek 6008 6008

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1``

   Link type (default Ethernet).

.. zeek:id:: BinPAC::flowbuffer_capacity_max
   :source-code: base/init-bare.zeek 6470 6470

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10485760``

   Maximum capacity, in bytes, that the BinPAC flowbuffer is allowed to
   grow to for use with incremental parsing of a given connection/analyzer.

.. zeek:id:: BinPAC::flowbuffer_capacity_min
   :source-code: base/init-bare.zeek 6475 6475

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``512``

   The initial capacity, in bytes, that will be allocated to the BinPAC
   flowbuffer of a given connection/analyzer.  If the buffer is
   later contracted, its capacity is also reduced to this size.

.. zeek:id:: BinPAC::flowbuffer_contract_threshold
   :source-code: base/init-bare.zeek 6483 6483

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``2097152``

   The threshold, in bytes, at which the BinPAC flowbuffer of a given
   connection/analyzer will have its capacity contracted to
   :zeek:see:`BinPAC::flowbuffer_capacity_min` after parsing a full unit.
   I.e. this is the maximum capacity to reserve in between the parsing of
   units.  If, after parsing a unit, the flowbuffer capacity is greater
   than this value, it will be contracted.

.. zeek:id:: Cluster::backend
   :source-code: base/init-bare.zeek 6311 6311

   :Type: :zeek:type:`Cluster::BackendTag`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``Cluster::CLUSTER_BACKEND_NONE``
   :Redefinition: from :doc:`/scripts/policy/frameworks/cluster/backend/broker/main.zeek`

      ``=``::

         ``Cluster::CLUSTER_BACKEND_BROKER``

   :Redefinition: from :doc:`/scripts/policy/frameworks/cluster/backend/zeromq/options.zeek`

      ``=``::

         ``Cluster::CLUSTER_BACKEND_ZEROMQ``

   :Redefinition: from :doc:`/scripts/test-all-policy.zeek`

      ``=``::

         ``Cluster::CLUSTER_BACKEND_NONE``


   Cluster backend to use. Default is the None backend.

.. zeek:id:: Cluster::event_serializer
   :source-code: base/init-bare.zeek 6316 6316

   :Type: :zeek:type:`Cluster::EventSerializerTag`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``Cluster::EVENT_SERIALIZER_BROKER_BIN_V1``

   The event serializer to use by the cluster backend.

   This currently has no effect for backend BROKER.

.. zeek:id:: Cluster::log_serializer
   :source-code: base/init-bare.zeek 6321 6321

   :Type: :zeek:type:`Cluster::LogSerializerTag`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``Cluster::LOG_SERIALIZER_ZEEK_BIN_V1``

   The log serializer to use by the backend.

   This currently has no effect for backend BROKER.

.. zeek:id:: ConnKey::factory
   :source-code: base/init-bare.zeek 682 682

   :Type: :zeek:type:`ConnKey::Tag`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``ConnKey::CONNKEY_FIVETUPLE``
   :Redefinition: from :doc:`/scripts/policy/frameworks/conn_key/vlan_fivetuple.zeek`

      ``=``::

         ``ConnKey::CONNKEY_VLAN_FIVETUPLE``


   The connection key factory to use for Zeek's internal connection
   tracking. This is a ``ConnKey::Tag`` plugin component enum value,
   and the default is Zeek's traditional 5-tuple-tracking based on
   IP/port endpoint pairs, plus transport protocol. Plugins can provide
   their own implementation. You'll usually not adjust this value in
   isolation, but with a corresponding redef of the :zeek:type:`conn_id`
   record to represent additional connection tuple members.

.. zeek:id:: ConnThreshold::generic_packet_thresholds
   :source-code: base/init-bare.zeek 6843 6843

   :Type: :zeek:type:`set` [:zeek:type:`count`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Number of packets required to be observed on any IP-based session to
   trigger :zeek:id:`conn_generic_packet_threshold_crossed`. Note that the
   thresholds refers to the total number of packets transferred in both
   directions.

   .. zeek:see:: conn_generic_packet_threshold_crossed

.. zeek:id:: DCE_RPC::max_cmd_reassembly
   :source-code: base/init-bare.zeek 6019 6019

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``20``

   The maximum number of simultaneous fragmented commands that
   the DCE_RPC analyzer will tolerate before the it will generate
   a weird and skip further input.

.. zeek:id:: DCE_RPC::max_frag_data
   :source-code: base/init-bare.zeek 6024 6024

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``30000``

   The maximum number of fragmented bytes that the DCE_RPC analyzer
   will tolerate on a command before the analyzer will generate a weird
   and skip further input.

.. zeek:id:: EventMetadata::add_missing_remote_network_timestamp
   :source-code: base/init-bare.zeek 669 669

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   By default, remote events without network timestamp metadata
   will yield a negative zeek:see:`current_event_time` during
   processing. To have the receiving Zeek node set the event's
   network timestamp metadata with its current local network time,
   set this option to true.

   This setting is only in effect if :zeek:see:`EventMetadata::add_network_timestamp`
   is also set to true.

.. zeek:id:: EventMetadata::add_network_timestamp
   :source-code: base/init-bare.zeek 659 659

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Add network timestamp metadata to all events.

   Adding network timestamp metadata affects local and
   remote events. Events scheduled have a network timestamp
   of when the scheduled timer was supposed to expire, which
   might be a value before the network_time() when the event
   was actually dispatched.

.. zeek:id:: FTP::max_command_length
   :source-code: base/init-bare.zeek 690 690

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   Limits the size of commands accepted by the FTP analyzer. Longer commands
   raise a FTP_max_command_length_exceeded weird and are discarded.

.. zeek:id:: Gnutella::max_header_length
   :source-code: base/init-bare.zeek 6294 6294

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``32768``

   Stop processing headers when the Gnutella headers hit this limit, with
   all included lines.

.. zeek:id:: Gnutella::max_line_length
   :source-code: base/init-bare.zeek 6290 6290

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``8192``

   Stop processing lines that exceed this byte limit before encountering
   a line terminator.

.. zeek:id:: HTTP::upgrade_analyzers
   :source-code: base/init-bare.zeek 821 821

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`Analyzer::Tag`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``
   :Redefinition: from :doc:`/scripts/base/protocols/websocket/main.zeek`

      ``+=``::

         websocket = Analyzer::ANALYZER_WEBSOCKET


   Lookup table for Upgrade analyzers. First, a case sensitive lookup
   is done using the client's Upgrade header. If no match is found,
   the all lower-case value is used. If there's still no match Zeek
   uses dynamic protocol detection for the upgraded to protocol instead.

.. zeek:id:: IP::protocol_names
   :source-code: base/init-bare.zeek 6623 6623

   :Type: :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef` :zeek:attr:`&default` = :zeek:type:`function`
   :Default:

      ::

         {
            [96] = "scc-sp",
            [73] = "cphb",
            [39] = "tp++",
            [46] = "rsvp",
            [28] = "irtp",
            [9] = "igp",
            [68] = "distributed-files",
            [107] = "a/n",
            [53] = "swipe",
            [71] = "ipcu",
            [127] = "crudp",
            [52] = "i-nlsp",
            [41] = "ipv6",
            [17] = "udp",
            [105] = "scps",
            [119] = "srp",
            [81] = "vmtp",
            [88] = "eigrp",
            [111] = "ipx-in-ip",
            [29] = "iso-tp4",
            [115] = "l2tp",
            [133] = "fc",
            [95] = "micp",
            [54] = "narp",
            [90] = "sprite-rpc",
            [146] = "homa",
            [86] = "dgp",
            [1] = "icmp",
            [116] = "ddx",
            [35] = "idpr",
            [102] = "pnni",
            [135] = "mobility-header",
            [3] = "ggp",
            [114] = "zero-hop",
            [140] = "shim6",
            [44] = "ipv6-frag",
            [129] = "iplt",
            [34] = "3pc",
            [45] = "idrp",
            [14] = "emcon",
            [31] = "mfe-nsp",
            [82] = "secure-vmtp",
            [56] = "tlsp",
            [7] = "cbt",
            [66] = "rvd",
            [26] = "leaf-2",
            [128] = "sccopmce",
            [47] = "gre",
            [70] = "visa",
            [93] = "ax.25",
            [2] = "igmp",
            [132] = "sctp",
            [72] = "cpnx",
            [24] = "trunk-2",
            [69] = "sat-on",
            [99] = "private-encryption",
            [109] = "snp",
            [103] = "pim",
            [126] = "crtp",
            [104] = "aris",
            [61] = "host-protocol",
            [60] = "ipv6-opts",
            [51] = "ah",
            [37] = "ddp",
            [18] = "mux",
            [0] = "hopopt",
            [110] = "compaq-peer",
            [137] = "mpls-in-ip",
            [94] = "os",
            [19] = "dcn-meas",
            [20] = "hmp",
            [33] = "dccp",
            [75] = "pvp",
            [67] = "ippc",
            [15] = "xnet",
            [30] = "netblt",
            [77] = "sun-and",
            [64] = "sat-expak",
            [106] = "qnx",
            [91] = "larp",
            [97] = "etherip",
            [55] = "mobile",
            [21] = "prm",
            [4] = "ip-in-ip",
            [12] = "pup",
            [124] = "is-is-over-ipv4",
            [130] = "sps",
            [58] = "ipv6-icmp",
            [134] = "rsvp-e2e-ignore",
            [80] = "iso-ip",
            [76] = "br-sat-mon",
            [25] = "leaf-1",
            [142] = "rohc",
            [16] = "chaos",
            [59] = "ipv6-nonxt",
            [38] = "idpr-cmtp",
            [63] = "local-network",
            [42] = "sdrp",
            [57] = "skip",
            [78] = "wb-mon",
            [98] = "encap",
            [11] = "nvp-ii",
            [113] = "pgm",
            [108] = "ipcomp",
            [22] = "xns-idp",
            [43] = "ipv6-route",
            [143] = "ethernet",
            [136] = "udplite",
            [144] = "aggfrag",
            [40] = "il",
            [36] = "xtp",
            [6] = "tcp",
            [125] = "fire",
            [141] = "wesp",
            [8] = "egp",
            [23] = "trunk-1",
            [27] = "rdp",
            [145] = "nsh",
            [83] = "vines",
            [122] = "sm",
            [92] = "mtp",
            [10] = "bbc-rcc-mon",
            [65] = "kryptolan",
            [13] = "argus",
            [32] = "merit-inp",
            [74] = "wsn",
            [62] = "cftp",
            [101] = "ifmp",
            [89] = "ospf",
            [118] = "stp",
            [138] = "manet",
            [139] = "hip",
            [50] = "esp",
            [120] = "uti",
            [79] = "wb-expak",
            [121] = "smp",
            [48] = "dsr",
            [85] = "nsfnet-igp",
            [49] = "bna",
            [5] = "st",
            [112] = "vrrp",
            [100] = "gtmp",
            [117] = "iatp",
            [123] = "ptp",
            [131] = "pipe",
            [87] = "tcf",
            [84] = "ttp or iptm"
         }


   Mapping from IP protocol identifier values to string names.

.. zeek:id:: KRB::keytab
   :source-code: base/init-bare.zeek 5661 5661

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``""``

   Kerberos keytab file name. Used to decrypt tickets encountered on the wire.

.. zeek:id:: Log::default_max_field_container_elements
   :source-code: base/init-bare.zeek 3936 3936

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of elements a single container field can contain when
   logging. If a container reaches this limit, the log output for the field will
   be truncated. Setting this to zero disables the limiting.

.. zeek:id:: Log::default_max_field_string_bytes
   :source-code: base/init-bare.zeek 3931 3931

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``4096``

   The maximum number of bytes that a single string field can contain when
   logging. If a string reaches this limit, the log output for the field will be
   truncated. Setting this to zero disables the limiting.

.. zeek:id:: Log::default_max_total_container_elements
   :source-code: base/init-bare.zeek 3951 3951

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``500``

   The maximum total number of container elements a record may log. This is the
   sum of all container elements logged for the record. If this limit is reached,
   all further containers will be logged as empty containers. If the limit is
   reached while processing a container, the container will be truncated in the
   output. Setting this to zero disables the limiting.

.. zeek:id:: Log::default_max_total_string_bytes
   :source-code: base/init-bare.zeek 3944 3944

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``256000``

   The maximum total bytes a record may log for string fields. This is the sum of
   all bytes in string fields logged for the record. If this limit is reached, all
   further string fields will be logged as empty strings. Any containers holding
   string fields will be logged as empty containers. If the limit is reached while
   processing a container holding string fields, the container will be truncated
   in the log output. Setting this to zero disables the limiting.

.. zeek:id:: Log::flush_interval
   :source-code: base/init-bare.zeek 3906 3906

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 sec``

   Default interval for flushing the write buffers of all
   enabled log streams.

   In earlier Zeek releases this was governed by :zeek:see:`Threading::heartbeat_interval`.
   For Broker, see also :zeek:see:`Broker::log_batch_interval`.

   Setting this value to a zero interval (0.0sec), disables the global
   log flushing timer. Note that it is then your responsibility to call
   :zeek:see:`Log::flush_all` regularly, or disable log buffering of
   all active streams via :zeek:see:`Log::set_buf`.

   .. :zeek:see:`Log::flush`
   .. :zeek:see:`Log::flush_all`
   .. :zeek:see:`Log::set_buf`
   .. :zeek:see:`Log::write_buffer_size`

.. zeek:id:: Log::max_log_record_size
   :source-code: base/init-bare.zeek 3926 3926

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``67108864``

   Maximum size of a message that can be sent to a remote logger or logged
   locally. If this limit is met, report a ``log_line_too_large`` weird and drop
   the log entry. This isn't necessarily the full size of a line that might be
   written to a log, but a general representation of the size as the log record is
   serialized for writing. The size of end result from serialization might be
   higher than this limit, but it prevents runaway-sized log entries from causing
   problems.

.. zeek:id:: Log::write_buffer_size
   :source-code: base/init-bare.zeek 3917 3917

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   Default maximum size of the log write buffer per filter/path pair.
   If this many log writes are buffered, the writer frontend flushes
   its writes to its backend before flush_interval expires.

   In earlier Zeek releases this was hard-coded to 1000.

   .. :zeek:see:`Log::flush`
   .. :zeek:see:`Log::set_buf`
   .. :zeek:see:`Log::flush_interval`

.. zeek:id:: MIME::max_depth
   :source-code: base/init-bare.zeek 3817 3817

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   Stop analysis of nested multipart MIME entities if this depth is
   reached. Setting this value to 0 removes the limit.

.. zeek:id:: MIME::max_header_bytes
   :source-code: base/init-bare.zeek 3821 3821

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``65536``

   Stop analysis of MIME headers that exceed this byte limit.
   Setting this value to 0 removes the limit.

.. zeek:id:: NCP::max_frame_size
   :source-code: base/init-bare.zeek 6031 6031

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``65536``

   The maximum number of bytes to allocate when parsing NCP frames.

.. zeek:id:: NFS3::return_data
   :source-code: base/init-bare.zeek 3503 3503

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, :zeek:see:`nfs_proc_read` and :zeek:see:`nfs_proc_write`
   events return the file data that has been read/written.

   .. zeek:see:: NFS3::return_data_max NFS3::return_data_first_only

.. zeek:id:: NFS3::return_data_first_only
   :source-code: base/init-bare.zeek 3512 3512

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   If :zeek:id:`NFS3::return_data` is true, whether to *only* return data
   if the read or write offset is 0, i.e., only return data for the
   beginning of the file.

.. zeek:id:: NFS3::return_data_max
   :source-code: base/init-bare.zeek 3507 3507

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``512``

   If :zeek:id:`NFS3::return_data` is true, how much data should be
   returned at most.

.. zeek:id:: POP3::max_pending_commands
   :source-code: base/init-bare.zeek 3961 3961

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   How many commands a POP3 client may have pending
   before Zeek forcefully removes the oldest.

   Setting this value to 0 removes the limit.

.. zeek:id:: POP3::max_unknown_client_commands
   :source-code: base/init-bare.zeek 3967 3967

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   How many invalid commands a POP3 client may use
   before Zeek starts raising analyzer violations.

   Setting this value to 0 removes the limit.

.. zeek:id:: Pcap::bufsize
   :source-code: base/init-bare.zeek 5927 5927

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``128``

   Number of Mbytes to provide as buffer space when capturing from live
   interfaces.

.. zeek:id:: Pcap::bufsize_offline_bytes
   :source-code: base/init-bare.zeek 5932 5932

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``131072``

   Number of bytes to use for buffering file read operations when reading
   from a PCAP file. Setting this to 0 uses operating system defaults
   as chosen by fopen().

.. zeek:id:: Pcap::non_fd_timeout
   :source-code: base/init-bare.zeek 5958 5958

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``20.0 usecs``

   Default timeout for packet sources without file descriptors.

   For libpcap based packet sources that do not provide a usable
   file descriptor for select(), the timeout provided to the IO
   loop is either zero if a packet was most recently available
   or else this value.

   Depending on the expected packet rate per-worker and the amount of
   available packet buffer, raising this value can significantly reduce
   Zeek's CPU usage at the cost of a small delay before processing
   packets. Setting this value too high may cause packet drops due
   to running out of available buffer space.

   Increasing this value to 200usec on low-traffic Myricom based systems
   (5 kpps per Zeek worker) has shown a 50% reduction in CPU usage.

   This is an advanced setting. Do monitor dropped packets and capture
   loss information when changing it.

   .. note:: Packet sources that override ``GetNextTimeout()`` method
      may not respect this value.

   .. zeek:see:: io_poll_interval_live


.. zeek:id:: Pcap::snaplen
   :source-code: base/init-bare.zeek 5923 5923

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``9216``

   Number of bytes per packet to capture from live interfaces.

.. zeek:id:: Reporter::errors_to_stderr
   :source-code: base/init-bare.zeek 5916 5916

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Tunable for sending reporter error messages to STDERR.  The option to
   turn it off is presented here in case Zeek is being run by some
   external harness and shouldn't output anything to the console.

.. zeek:id:: Reporter::info_to_stderr
   :source-code: base/init-bare.zeek 5906 5906

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Tunable for sending reporter info messages to STDERR.  The option to
   turn it off is presented here in case Zeek is being run by some
   external harness and shouldn't output anything to the console.

.. zeek:id:: Reporter::warnings_to_stderr
   :source-code: base/init-bare.zeek 5911 5911

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Tunable for sending reporter warning messages to STDERR.  The option
   to turn it off is presented here in case Zeek is being run by some
   external harness and shouldn't output anything to the console.

.. zeek:id:: SMB::max_andx_depth
   :source-code: base/init-bare.zeek 4275 4275

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   Maximum number of AndX commands that are allowed in a chain. When the limit is
   reached, a `smb_andx_depth_exceeded` weird is raised. Setting this to zero will
   disable the functionality.

.. zeek:id:: SMB::max_dce_rpc_analyzers
   :source-code: base/init-bare.zeek 4270 4270

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   Maximum number of DCE-RPC analyzers per connection
   before discarding them to avoid unbounded state growth.

   .. zeek:see:: smb_discarded_dce_rpc_analyzers

.. zeek:id:: SMB::max_pending_messages
   :source-code: base/init-bare.zeek 4264 4264

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   The maximum number of messages for which to retain state
   about offsets, fids, or tree ids within the parser. When
   the limit is reached, internal parser state is discarded
   and :zeek:see:`smb2_discarded_messages_state` raised.

   Setting this to zero will disable the functionality.

   .. zeek:see:: smb2_discarded_messages_state

.. zeek:id:: SMB::pipe_filenames
   :source-code: base/init-bare.zeek 4254 4254

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``
   :Redefinition: from :doc:`/scripts/base/protocols/smb/consts.zeek`

      ``=``::

         spoolss, winreg, samr, srvsvc, netdfs, lsarpc, wkssvc, MsFteWds


   A set of file names used as named pipes over SMB. This
   only comes into play as a heuristic to identify named
   pipes when the drive mapping wasn't seen by Zeek.

   .. zeek:see:: smb_pipe_connect_heuristic

.. zeek:id:: SMTP::bdat_max_line_length
   :source-code: base/init-bare.zeek 699 699

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``4096``

   The maximum line length within a BDAT chunk before a forceful linebreak
   is introduced and a weird is raised. Conventionally, MIME messages
   have a maximum line length of 1000 octets when properly encoded.

.. zeek:id:: SMTP::enable_rfc822_msg_file_analysis
   :source-code: base/init-bare.zeek 707 707

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether to send data of individual top-level RFC822 messages
   in SMTP transactions to the file analysis framework.

   If this option is enabled, the first :zeek:see:`file_over_new_connection`
   event for a new SMTP transaction will be for the top-level RFC822
   message. The file's :zeek:field:`mime_type` will be ``message/rfc822``.

.. zeek:id:: SSH::max_kexinit_compression_algorithms
   :source-code: base/init-bare.zeek 4072 4072

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of compression algorithms extracted from a
   KEXINIT packet and included in the ``ssh_capabilities`` event.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_compression_algorithms_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_kexinit_encryption_algorithms
   :source-code: base/init-bare.zeek 4058 4058

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of encryption algorithms extracted from a
   KEXINIT packet and included in the ``ssh_capabilities`` event.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_encryption_algorithms_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_kexinit_hostkey_algorithms
   :source-code: base/init-bare.zeek 4051 4051

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of hostkey algorithms extracted from a
   KEXINIT packet and included in the ``ssh_capabilities`` event.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_hostkey_algorithms_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_kexinit_kex_algorithms
   :source-code: base/init-bare.zeek 4044 4044

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of KEX algorithms extracted from a KEXINIT packet
   and included in the ``ssh_capabilities`` event. As a consequence, this
   also limits the number of KEX algorithms used to determine which one
   was chosen.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_kex_algorithms_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_kexinit_languages
   :source-code: base/init-bare.zeek 4079 4079

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of languages extracted from a
   KEXINIT packet and included in the ``ssh_capabilities`` event.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_languages_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_kexinit_mac_algorithms
   :source-code: base/init-bare.zeek 4065 4065

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   The maximum number of mac algorithms extracted from a
   KEXINIT packet and included in the ``ssh_capabilities`` event.
   Setting this value to zero disables the limit. If the limit
   is reached, a ``SSH_max_kexinit_mac_algorithms_exceeded``
   weird is raised and an X added to the connection's history.

.. zeek:id:: SSH::max_packet_length
   :source-code: base/init-bare.zeek 4024 4024

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``8388608``

   When the SSH analyzer observes packets with a packet length
   field that exceeds below value, it truncates the length to
   the limit and raises a ``SSH_max_packet_exceeded`` weird.
   Subsequent parsing will likely fail, but it's probable that
   this was not valid SSH traffic to begin with.
   According to RFC 4253, the minimum packet length all implementations
   must support is an arbitrary 35000 bytes. The default is 8MB,
   which is a roughly double and two magnitutes larger than that.

   Setting this value to zero disables the capping mechanism.

.. zeek:id:: SSH::max_string_length
   :source-code: base/init-bare.zeek 4035 4035

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``2097152``

   When the SSH analyzer observes SSH string fields with lengths
   that exceeds below value, it truncates the length to
   the limit and raises a ``SSH_max_string_length_exceeded`` weird.
   Subsequent parsing will likely fail, but it's probable that
   this was not valid SSH traffic to begin with. Strings are used
   to exchange MAC and compression algorithms. A 2MB string listing
   such algorithms is weird.

   Setting this value to zero disables the capping mechanism.

.. zeek:id:: SSL::dtls_max_reported_version_errors
   :source-code: base/init-bare.zeek 5300 5300

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1``

   Maximum number of invalid version errors to report in one DTLS connection.

.. zeek:id:: SSL::dtls_max_version_errors
   :source-code: base/init-bare.zeek 5297 5297

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   Number of non-DTLS frames that can occur in a DTLS connection before
   parsing of the connection is suspended.
   DTLS does not immediately stop parsing a connection because other protocols
   might be interleaved in the same UDP "connection".

.. zeek:id:: SSL::max_alerts_per_record
   :source-code: base/init-bare.zeek 5305 5305

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   Maximum number of Alert messages parsed from an SSL record with
   content_type alert (21). The remaining alerts are discarded. For
   TLS 1.3 connections, this is implicitly 1 as defined by RFC 8446.

.. zeek:id:: Storage::expire_interval
   :source-code: base/init-bare.zeek 6782 6782

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``15.0 secs``

   The interval used by the storage framework for automatic expiration
   of elements in all backends that don't support it natively, or if
   using expiration while reading pcap files.

.. zeek:id:: Telemetry::callback_timeout
   :source-code: base/init-bare.zeek 6613 6613

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   Maximum amount of time for CivetWeb HTTP threads to
   wait for metric callbacks to complete on the IO loop.

.. zeek:id:: Telemetry::civetweb_threads
   :source-code: base/init-bare.zeek 6616 6616

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``2``

   Number of CivetWeb threads to use.

.. zeek:id:: Threading::heartbeat_interval
   :source-code: base/init-bare.zeek 3977 3977

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 sec``

   The heartbeat interval used by the threading framework.
   Changing this should usually not be necessary and will break
   several tests.

.. zeek:id:: Tunnel::delay_gtp_confirmation
   :source-code: base/init-bare.zeek 800 800

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   With this set, the GTP analyzer waits until the most-recent upflow
   and downflow packets are a valid GTPv1 encapsulation before
   issuing :zeek:see:`analyzer_confirmation_info`.  If it's false, the
   first occurrence of a packet with valid GTPv1 encapsulation causes
   confirmation.  Since the same inner connection can be carried
   differing outer upflow/downflow connections, setting to false
   may work better.

.. zeek:id:: Tunnel::delay_teredo_confirmation
   :source-code: base/init-bare.zeek 791 791

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   With this set, the Teredo analyzer waits until it sees both sides
   of a connection using a valid Teredo encapsulation before issuing
   a :zeek:see:`analyzer_confirmation_info`.  If it's false, the first
   occurrence of a packet with valid Teredo encapsulation causes a
   confirmation.

.. zeek:id:: Tunnel::ip_tunnel_timeout
   :source-code: base/init-bare.zeek 804 804

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 day``

   How often to cleanup internal state for inactive IP tunnels
   (includes GRE tunnels).

.. zeek:id:: Tunnel::max_changes_per_connection
   :source-code: base/init-bare.zeek 780 780

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5``

   The number of tunnel_changed events that will be sent for a connection. Once
   this limit is hit, no more of those events will be sent to avoid a large number
   of events being sent for connections that regularly swap. This can be set to
   zero to disable this limiting. This has a maximum value of 255.

.. zeek:id:: Tunnel::max_depth
   :source-code: base/init-bare.zeek 784 784

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``4``

   The maximum depth of a tunnel to decapsulate until giving up.
   Setting this to zero will disable all types of tunnel decapsulation.

.. zeek:id:: Tunnel::validate_vxlan_checksums
   :source-code: base/init-bare.zeek 810 810

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Whether to validate the checksum supplied in the outer UDP header
   of a VXLAN encapsulation.  The spec says the checksum should be
   transmitted as zero, but if not, then the decapsulating destination
   may choose whether to perform the validation.

.. zeek:id:: UnknownProtocol::first_bytes_count
   :source-code: base/init-bare.zeek 6462 6462

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   The number of bytes to extract from the next header and log in the
   first bytes field.

.. zeek:id:: UnknownProtocol::sampling_duration
   :source-code: base/init-bare.zeek 6458 6458

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 hr``

   How long an analyzer/protocol pair is allowed to keep state/counters in
   in memory. Once the threshold has been hit, this is the amount of time
   before the rate-limiting for a pair expires and is reset.

.. zeek:id:: UnknownProtocol::sampling_rate
   :source-code: base/init-bare.zeek 6453 6453

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100000``

   The rate-limiting sampling rate. One out of every of this number of
   rate-limited pairs of a given type will be allowed to raise events
   for further script-layer handling. Setting the sampling rate to 0
   will disable all output of rate-limited pairs.

.. zeek:id:: UnknownProtocol::sampling_threshold
   :source-code: base/init-bare.zeek 6447 6447

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``3``

   How many reports for an analyzer/protocol pair will be allowed to
   raise events before becoming rate-limited.

.. zeek:id:: WebSocket::max_control_frame_size
   :source-code: base/init-bare.zeek 838 838

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``125``

   The WebSocket analyzer will cap any control frames
   (CLOSE, PING, PONG) to this limit and emit a weird if
   exceeded. This is defined in the RFC as 125 bytes.
   Set to 0 to disable this check.

.. zeek:id:: WebSocket::payload_chunk_size
   :source-code: base/init-bare.zeek 832 832

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``8192``

   The WebSocket analyzer consumes and forwards
   frame payload in chunks to keep memory usage
   bounded. There should not be a reason to change
   this value except for debugging and
   testing reasons.

.. zeek:id:: WebSocket::use_dpd_default
   :source-code: base/init-bare.zeek 841 841

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Whether to enable DPD on WebSocket frame payload by default.

.. zeek:id:: WebSocket::use_spicy_analyzer
   :source-code: base/init-bare.zeek 847 847

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether to use the Spicy WebSocket protocol analyzer.

   As of now, the BinPac version has better performance, but
   we may change the default in the future.

.. zeek:id:: allow_network_time_forward
   :source-code: base/init-bare.zeek 195 195

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Whether Zeek will forward network_time to the current time upon
   observing an idle packet source (or no configured packet source).

   Only set this to *F* if you really know what you're doing. Setting this to
   *F* on non-worker systems causes :zeek:see:`network_time` to be stuck
   at 0.0 and timer expiration will be non-functional.

   The main purpose of this option is to yield control over network time
   to plugins or scripts via broker or other non-timer events.

   .. zeek:see:: network_time set_network_time packet_source_inactivity_timeout


.. zeek:id:: bits_per_uid
   :source-code: base/init-bare.zeek 588 588

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``96``

   Number of bits in UIDs that are generated to identify connections and
   files.  The larger the value, the more confidence in UID uniqueness.
   The maximum is currently 128 bits.

.. zeek:id:: cmd_line_bpf_filter
   :source-code: base/init-bare.zeek 441 441

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``""``

   BPF filter the user has set via the -f command line options. Empty if none.

.. zeek:id:: detect_filtered_trace
   :source-code: base/init-bare.zeek 450 450

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether to attempt to automatically detect SYN/FIN/RST-filtered trace
   and not report missing segments for such connections.
   If this is enabled, then missing data at the end of connections may not
   be reported via :zeek:see:`content_gap`.

.. zeek:id:: digest_salt
   :source-code: base/init-bare.zeek 596 596

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"Please change this value."``

   This salt value is used for several message digests in Zeek. We
   use a salt to help mitigate the possibility of an attacker
   manipulating source data to, e.g., mount complexity attacks or
   cause ID collisions.
   This salt is, for example, used by :zeek:see:`get_file_handle`
   to generate installation-unique file IDs (the *id* field of :zeek:see:`fa_file`).

.. zeek:id:: dns_session_timeout
   :source-code: base/init-bare.zeek 1977 1977

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 secs``

   Time to wait before timing out a DNS request.

.. zeek:id:: dpd_buffer_size
   :source-code: base/init-bare.zeek 507 507

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1024``

   Size of per-connection buffer used for dynamic protocol detection. For each
   connection, Zeek buffers this initial amount of payload in memory so that
   complete protocol analysis can start even after the initial packets have
   already passed through (i.e., when a DPD signature matches only later).
   However, once the buffer is full, data is deleted and lost to analyzers that
   are activated afterwards. Then only analyzers that can deal with partial
   connections will be able to analyze the session.

   .. zeek:see:: dpd_reassemble_first_packets dpd_match_only_beginning
      dpd_ignore_ports dpd_max_packets

.. zeek:id:: dpd_ignore_ports
   :source-code: base/init-bare.zeek 548 548

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, don't consider any ports for deciding which protocol analyzer to
   use.

   .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
      dpd_match_only_beginning

.. zeek:id:: dpd_late_match_stop
   :source-code: base/init-bare.zeek 541 541

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``
   :Redefinition: from :doc:`/scripts/policy/protocols/conn/speculative-service.zeek`

      ``=``::

         ``T``


   If true, stops signature matching after a late match. A late match may occur
   in case the DPD buffer is exhausted but a protocol signature matched. To
   allow late matching, :zeek:see:`dpd_match_only_beginning` must be disabled.

   .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
      dpd_match_only_beginning

   .. note:: Despite the name, this option stops *all* signature matching, not
      only signatures used for dynamic protocol detection but is triggered by
      DPD signatures only.

.. zeek:id:: dpd_match_only_beginning
   :source-code: base/init-bare.zeek 529 529

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``
   :Redefinition: from :doc:`/scripts/policy/protocols/conn/speculative-service.zeek`

      ``=``::

         ``F``


   If true, stops signature matching if :zeek:see:`dpd_buffer_size` has been
   reached.

   .. zeek:see:: dpd_reassemble_first_packets dpd_buffer_size
      dpd_ignore_ports

   .. note:: Despite the name, this option affects *all* signature matching, not
      only signatures used for dynamic protocol detection.

.. zeek:id:: dpd_max_packets
   :source-code: base/init-bare.zeek 519 519

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   Maximum number of per-connection packets that will be buffered for dynamic
   protocol detection. For each connection, Zeek buffers up to this amount
   of packets in memory so that complete protocol analysis can start even after
   the initial packets have already passed through (i.e., when a DPD signature
   matches only later). However, once the buffer is full, data is deleted and lost
   to analyzers that are activated afterwards. Then only analyzers that can deal
   with partial connections will be able to analyze the session.

   .. zeek:see:: dpd_reassemble_first_packets dpd_match_only_beginning
      dpd_ignore_ports dpd_buffer_size

.. zeek:id:: dpd_reassemble_first_packets
   :source-code: base/init-bare.zeek 495 495

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Reassemble the beginning of all TCP connections before doing
   signature matching. Enabling this provides more accurate matching at the
   expense of CPU cycles.

   .. zeek:see:: dpd_buffer_size
      dpd_match_only_beginning dpd_ignore_ports

   .. note:: Despite the name, this option affects *all* signature matching, not
      only signatures used for dynamic protocol detection.

.. zeek:id:: exit_only_after_terminate
   :source-code: base/init-bare.zeek 466 466

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Flag to prevent Zeek from exiting automatically when input is exhausted.
   Normally Zeek terminates when all packet sources have gone dry
   and communication isn't enabled. If this flag is set, Zeek's main loop will
   instead keep idling until :zeek:see:`terminate` is explicitly called.

   This is mainly for testing purposes when termination behaviour needs to be
   controlled for reproducing results.

.. zeek:id:: expensive_profiling_multiple
   :source-code: base/init-bare.zeek 2977 2977

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0``
   :Redefinition: from :doc:`/scripts/policy/misc/profiling.zeek`

      ``=``::

         ``20``


   Multiples of :zeek:see:`profiling_interval` at which (more expensive) memory
   profiling is done (0 disables).

   .. zeek:see:: profiling_interval profiling_file

.. zeek:id:: frag_timeout
   :source-code: base/init-bare.zeek 1993 1993

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 mins``

   How long to hold onto fragments for possible reassembly.  A value of 0.0
   means "forever", which resists evasion, but can lead to state accrual.

.. zeek:id:: global_hash_seed
   :source-code: base/init-bare.zeek 583 583

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``""``

   Seed for hashes computed internally for probabilistic data structures. Using
   the same value here will make the hashes compatible between independent Zeek
   instances. If left unset, Zeek will use a temporary local seed.

.. zeek:id:: icmp_inactivity_timeout
   :source-code: base/init-bare.zeek 1803 1803

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 min``

   If an ICMP flow is inactive, time it out after this interval. If 0 secs, then
   don't time it out.

   .. zeek:see:: tcp_inactivity_timeout udp_inactivity_timeout unknown_ip_inactivity_timeout set_inactivity_timeout

.. zeek:id:: ignore_checksums
   :source-code: base/init-bare.zeek 1732 1732

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, don't verify checksums, and accept packets that give a length of
   zero in the IPv4 header. This is useful when running against traces of local
   traffic and the NIC checksum offloading feature is enabled. It can also
   be useful for running on altered trace files, and for saving a few cycles
   at the risk of analyzing invalid data.
   With this option, packets that have a value of zero in the total-length field
   of the IPv4 header are also accepted, and the capture-length is used instead.
   The total-length field is commonly set to zero when the NIC sequence offloading
   feature is enabled.
   Note that the ``-C`` command-line option overrides the setting of this
   variable.

.. zeek:id:: ignore_keep_alive_rexmit
   :source-code: base/init-bare.zeek 576 576

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Ignore certain TCP retransmissions for :zeek:see:`conn_stats`.  Some
   connections (e.g., SSH) retransmit the acknowledged last byte to keep the
   connection alive. If *ignore_keep_alive_rexmit* is set to true, such
   retransmissions will be excluded in the rexmit counter in
   :zeek:see:`conn_stats`.

   .. zeek:see:: conn_stats

.. zeek:id:: io_poll_interval_default
   :source-code: base/init-bare.zeek 613 613

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100``

   How many rounds to go without checking IO sources with file descriptors
   for readiness by default. This is used when reading from traces.

   Very roughly, when reading from a pcap, setting this to 100 results in
   100 packets being processed without checking FD based IO sources.

   .. note:: This should not be changed outside of development or when
      debugging problems with the main-loop, or developing features with
      tight main-loop interaction.

   .. zeek:see:: io_poll_interval_live

.. zeek:id:: io_poll_interval_live
   :source-code: base/init-bare.zeek 628 628

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10``

   How often to check IO sources with file descriptors for readiness when
   monitoring with a live packet source.

   The poll interval gets defaulted to 100 which is good for cases like reading
   from pcap files and when there isn't a packet source, but is a little too
   infrequent for live sources (especially fast live sources). Set it down a
   little bit for those sources.

   .. note:: This should not be changed outside of development or when
      debugging problems with the main-loop, or developing features with
      tight main-loop interaction.

   .. zeek:see:: io_poll_interval_default

.. zeek:id:: likely_server_ports
   :source-code: base/init-bare.zeek 553 553

   :Type: :zeek:type:`set` [:zeek:type:`port`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Ports which the core considers being likely used by servers. For ports in
   this set, it may heuristically decide to flip the direction of the
   connection if it misses the initial handshake.

.. zeek:id:: log_rotate_base_time
   :source-code: base/init-bare.zeek 444 444

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"0:00"``

   Base time of log rotations in 24-hour time format (``%H:%M``), e.g. "12:00".

.. zeek:id:: max_analyzer_violations
   :source-code: base/init-bare.zeek 1154 1154

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   The maximum number of analyzer violations the core generates before
   suppressing them for a given analyzer instance. A weird providing
   information about the analyzer and connection is generated once the
   limit is reached.

   An analyzer generating this many violations is unlikely parsing
   the right protocol or potentially buggy.

.. zeek:id:: max_find_all_string_length
   :source-code: base/init-bare.zeek 600 600

   :Type: :zeek:type:`int`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10000``

   Maximum string length allowed for calls to the :zeek:see:`find_all` and
   :zeek:see:`find_all_ordered` BIFs.

.. zeek:id:: max_timer_expires
   :source-code: base/init-bare.zeek 2793 2793

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``300``

   The maximum number of expired timers to process after processing each new
   packet. The value trades off spreading out the timer expiration load
   with possibly having to hold state longer.  A value of 0 means
   "process all expired timers with each new packet".

.. zeek:id:: mmdb_asn_db
   :source-code: base/init-bare.zeek 1658 1658

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"GeoLite2-ASN.mmdb"``

   Default name of the MaxMind ASN database file:

.. zeek:id:: mmdb_city_db
   :source-code: base/init-bare.zeek 1654 1654

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"GeoLite2-City.mmdb"``

   Default name of the MaxMind City database file:

.. zeek:id:: mmdb_country_db
   :source-code: base/init-bare.zeek 1656 1656

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"GeoLite2-Country.mmdb"``

   Default name of the MaxMind Country database file:

.. zeek:id:: mmdb_dir
   :source-code: base/init-bare.zeek 1651 1651

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``""``

   The directory containing MaxMind DB (.mmdb) files to use for GeoIP support.

.. zeek:id:: mmdb_dir_fallbacks
   :source-code: base/init-bare.zeek 1665 1665

   :Type: :zeek:type:`vector` of :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default:

      ::

         ["/usr/share/GeoIP", "/var/lib/GeoIP", "/usr/local/share/GeoIP", "/usr/local/var/GeoIP"]


   Fallback locations for MaxMind databases. Zeek attempts these when
   :zeek:see:`mmdb_dir` is not set, or it cannot read a DB file from it. For
   geolocation lookups, Zeek will first attempt to locate the city database in
   each of the fallback locations, and should this fail, attempt to locate the
   country one.

.. zeek:id:: mmdb_stale_check_interval
   :source-code: base/init-bare.zeek 1675 1675

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 mins``

   Sets the interval for MaxMind DB file staleness checks. When Zeek detects a
   change in inode or modification time, the database is re-opened. Setting
   a negative interval disables staleness checks.

.. zeek:id:: netbios_ssn_session_timeout
   :source-code: base/init-bare.zeek 636 636

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``15.0 secs``

   The amount of time before a connection created by the netbios analyzer times
   out and is removed.

.. zeek:id:: non_analyzed_lifetime
   :source-code: base/init-bare.zeek 1785 1785

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0 secs``

   If a connection belongs to an application that we don't analyze,
   time it out after this interval.  If 0 secs, then don't time it out (but
   :zeek:see:`tcp_inactivity_timeout`, :zeek:see:`udp_inactivity_timeout`, and
   :zeek:see:`icmp_inactivity_timeout` still apply).

.. zeek:id:: packet_filter_default
   :source-code: base/init-bare.zeek 478 478

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Default mode for Zeek's user-space dynamic packet filter. If true, packets
   that aren't explicitly allowed through, are dropped from any further
   processing.

   .. note:: This is not the BPF packet filter but an additional dynamic filter
      that Zeek optionally applies just before normal processing starts.

   .. zeek:see:: install_dst_addr_filter install_dst_net_filter
      install_src_addr_filter install_src_net_filter  uninstall_dst_addr_filter
      uninstall_dst_net_filter uninstall_src_addr_filter uninstall_src_net_filter

.. zeek:id:: packet_source_inactivity_timeout
   :source-code: base/init-bare.zeek 181 181

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``100.0 msecs``

   If a packet source does not yield packets for this amount of time,
   it is considered idle. When a packet source is found to be idle,
   Zeek will update network_time to current time in order for timer expiration
   to function. A packet source queueing up packets and not yielding them for
   longer than this interval without yielding any packets will provoke
   not-very-well-defined timer behavior.

   On Zeek workers with low packet rates, timer expiration may be delayed
   by this many milliseconds after the last packet has been received.

.. zeek:id:: partial_connection_ok
   :source-code: base/init-bare.zeek 1743 1743

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   If true, instantiate connection state when a partial connection
   (one missing its initial establishment negotiation) is seen.

.. zeek:id:: peer_description
   :source-code: base/init-bare.zeek 484 484

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``"zeek"``

   Description transmitted to remote communication peers for identification.

.. zeek:id:: pkt_profile_freq
   :source-code: base/init-bare.zeek 2997 2997

   :Type: :zeek:type:`double`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0.0``

   Frequency associated with packet profiling.

   .. zeek:see:: pkt_profile_modes pkt_profile_mode pkt_profile_file

.. zeek:id:: pkt_profile_mode
   :source-code: base/init-bare.zeek 2992 2992

   :Type: :zeek:type:`pkt_profile_modes`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``PKT_PROFILE_MODE_NONE``

   Output mode for packet profiling information.

   .. zeek:see:: pkt_profile_modes pkt_profile_freq pkt_profile_file

.. zeek:id:: profiling_interval
   :source-code: base/init-bare.zeek 2971 2971

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0 secs``
   :Redefinition: from :doc:`/scripts/policy/misc/profiling.zeek`

      ``=``::

         ``15.0 secs``


   Update interval for profiling (0 disables).  The easiest way to activate
   profiling is loading  :doc:`/scripts/policy/misc/profiling.zeek`.

   .. zeek:see:: profiling_file expensive_profiling_multiple

.. zeek:id:: record_all_packets
   :source-code: base/init-bare.zeek 567 567

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If a trace file is given with ``-w``, dump *all* packets seen by Zeek into it.
   By default, Zeek applies (very few) heuristics to reduce the volume. A side
   effect of setting this to true is that we can write the packets out before we
   actually process them, which can be helpful for debugging in case the
   analysis triggers a crash.

   .. zeek:see:: trace_output_file

.. zeek:id:: report_gaps_for_partial
   :source-code: base/init-bare.zeek 457 457

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether we want :zeek:see:`content_gap` for partial
   connections. A connection is partial if it is missing a full handshake. Note
   that gap reports for partial connections might not be reliable.

   .. zeek:see:: content_gap partial_connection

.. zeek:id:: rpc_max_pending_calls
   :source-code: base/init-bare.zeek 1989 1989

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   Maximum number of pending RPC calls without replies.

   When a new RPC call needs to be stored that would exceed this value,
   Zeek will discard all currently pending RPC calls and raise
   a ``RPC_pending_calls_discarded`` weird as well as the
   :zeek:see:`rpc_discarded_pending_calls` event. Setting this value
   to 0 disables the limit. This may lead to unbounded state growth.

.. zeek:id:: rpc_timeout
   :source-code: base/init-bare.zeek 1980 1980

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``24.0 secs``

   Time to wait before timing out an RPC request.

.. zeek:id:: running_under_test
   :source-code: base/init-bare.zeek 632 632

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Whether Zeek is being run under test. This can be used to alter functionality
   while testing, but should be used sparingly.

.. zeek:id:: sig_max_group_size
   :source-code: base/init-bare.zeek 481 481

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``50``

   Maximum size of regular expression groups for signature matching.

.. zeek:id:: skip_http_data
   :source-code: base/init-bare.zeek 3356 3356

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   Skip HTTP data for performance considerations. The skipped
   portion will not go through TCP reassembly.

   .. zeek:see:: http_entity_data skip_http_entity_data http_entity_data_delivery_size

.. zeek:id:: table_expire_delay
   :source-code: base/init-bare.zeek 1974 1974

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 msecs``

   When expiring table entries, wait this amount of time before checking the
   next chunk of entries.

   .. zeek:see:: table_expire_interval table_incremental_step

.. zeek:id:: table_expire_interval
   :source-code: base/init-bare.zeek 1962 1962

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 secs``
   :Redefinition: from :doc:`/scripts/policy/frameworks/management/agent/main.zeek`

      ``=``::

         ``2.0 secs``

   :Redefinition: from :doc:`/scripts/policy/frameworks/management/controller/main.zeek`

      ``=``::

         ``2.0 secs``


   Check for expired table entries after this amount of time.

   .. zeek:see:: table_incremental_step table_expire_delay

.. zeek:id:: table_incremental_step
   :source-code: base/init-bare.zeek 1968 1968

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5000``

   When expiring/serializing table entries, don't work on more than this many
   table entries at a time.

   .. zeek:see:: table_expire_interval table_expire_delay

.. zeek:id:: tcp_SYN_ack_ok
   :source-code: base/init-bare.zeek 1747 1747

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   If true, instantiate connection state when a SYN/ACK is seen but not the
   initial SYN (even if :zeek:see:`partial_connection_ok` is false).

.. zeek:id:: tcp_SYN_timeout
   :source-code: base/init-bare.zeek 1755 1755

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   Check up on the result of an initial SYN after this much time.

.. zeek:id:: tcp_attempt_delay
   :source-code: base/init-bare.zeek 1768 1768

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   Wait this long upon seeing an initial SYN before timing out the
   connection attempt.

.. zeek:id:: tcp_close_delay
   :source-code: base/init-bare.zeek 1771 1771

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   Upon seeing a normal connection close, flush state after this much time.

.. zeek:id:: tcp_connection_linger
   :source-code: base/init-bare.zeek 1764 1764

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   When checking a closed connection for further activity, consider it
   inactive if there hasn't been any for this long.  Complain if the
   connection is reused before this much time has elapsed.

.. zeek:id:: tcp_content_deliver_all_orig
   :source-code: base/init-bare.zeek 1887 1887

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, all TCP originator-side traffic is reported via
   :zeek:see:`tcp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig tcp_content_delivery_ports_resp
      tcp_content_deliver_all_resp udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_content_deliver_all_resp tcp_contents

.. zeek:id:: tcp_content_deliver_all_resp
   :source-code: base/init-bare.zeek 1897 1897

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, all TCP responder-side traffic is reported via
   :zeek:see:`tcp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp
      tcp_content_deliver_all_orig udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_content_deliver_all_resp tcp_contents

.. zeek:id:: tcp_content_delivery_ports_orig
   :source-code: base/init-bare.zeek 1869 1869

   :Type: :zeek:type:`table` [:zeek:type:`port`] of :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Defines destination TCP ports for which the contents of the originator stream
   should be delivered via :zeek:see:`tcp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_resp tcp_content_deliver_all_orig
      tcp_content_deliver_all_resp udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_content_deliver_all_resp  tcp_contents

.. zeek:id:: tcp_content_delivery_ports_resp
   :source-code: base/init-bare.zeek 1878 1878

   :Type: :zeek:type:`table` [:zeek:type:`port`] of :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Defines destination TCP ports for which the contents of the responder stream
   should be delivered via :zeek:see:`tcp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig tcp_content_deliver_all_orig
      tcp_content_deliver_all_resp udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_content_deliver_all_resp tcp_contents

.. zeek:id:: tcp_excessive_data_without_further_acks
   :source-code: base/init-bare.zeek 1855 1855

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10485760``

   If we've seen this much data without any of it being acked, we give up
   on that connection to avoid memory exhaustion due to buffering all that
   stuff.  If set to zero, then we don't ever give up.  Ideally, Zeek would
   track the current window on a connection and use it to infer that data
   has in fact gone too far, but for now we just make this quite beefy.

   .. zeek:see:: tcp_max_initial_window tcp_max_above_hole_without_any_acks

.. zeek:id:: tcp_inactivity_timeout
   :source-code: base/init-bare.zeek 1791 1791

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 mins``

   If a TCP connection is inactive, time it out after this interval. If 0 secs,
   then don't time it out.

   .. zeek:see:: udp_inactivity_timeout icmp_inactivity_timeout unknown_ip_inactivity_timeout set_inactivity_timeout

.. zeek:id:: tcp_match_undelivered
   :source-code: base/init-bare.zeek 1752 1752

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   If true, pass any undelivered to the signature engine before flushing the state.
   If a connection state is removed, there may still be some data waiting in the
   reassembler.

.. zeek:id:: tcp_max_above_hole_without_any_acks
   :source-code: base/init-bare.zeek 1846 1846

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``16384``

   If we're not seeing our peer's ACKs, the maximum volume of data above a
   sequence hole that we'll tolerate before assuming that there's been a packet
   drop and we should give up on tracking a connection. If set to zero, then we
   don't ever give up.

   .. zeek:see:: tcp_max_initial_window tcp_excessive_data_without_further_acks

.. zeek:id:: tcp_max_initial_window
   :source-code: base/init-bare.zeek 1838 1838

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``16384``

   Maximum amount of data that might plausibly be sent in an initial flight
   (prior to receiving any acks).  Used to determine whether we must not be
   seeing our peer's ACKs.  Set to zero to turn off this determination.

   .. zeek:see:: tcp_max_above_hole_without_any_acks tcp_excessive_data_without_further_acks

.. zeek:id:: tcp_max_old_segments
   :source-code: base/init-bare.zeek 1860 1860

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0``

   Number of TCP segments to buffer beyond what's been acknowledged already
   to detect retransmission inconsistencies. Zero disables any additional
   buffering.

.. zeek:id:: tcp_partial_close_delay
   :source-code: base/init-bare.zeek 1779 1779

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``3.0 secs``

   Generate a :zeek:id:`connection_partial_close` event this much time after one
   half of a partial connection closes, assuming there has been no subsequent
   activity.

.. zeek:id:: tcp_reset_delay
   :source-code: base/init-bare.zeek 1774 1774

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``5.0 secs``

   Upon seeing a RST, flush state after this much time.

.. zeek:id:: tcp_session_timer
   :source-code: base/init-bare.zeek 1759 1759

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``6.0 secs``

   After a connection has closed, wait this long for further activity
   before checking whether to time out its state.

.. zeek:id:: tcp_storm_interarrival_thresh
   :source-code: base/init-bare.zeek 1831 1831

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 sec``

   FINs/RSTs must come with this much time or less between them to be
   considered a "storm".

   .. zeek:see:: tcp_storm_thresh

.. zeek:id:: tcp_storm_thresh
   :source-code: base/init-bare.zeek 1825 1825

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1000``

   Number of FINs/RSTs in a row that constitute a "storm". Storms are reported
   as ``weird`` via the notice framework, and they must also come within
   intervals of at most :zeek:see:`tcp_storm_interarrival_thresh`.

   .. zeek:see:: tcp_storm_interarrival_thresh

.. zeek:id:: truncate_http_URI
   :source-code: base/init-bare.zeek 3363 3363

   :Type: :zeek:type:`int`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``-1``

   Maximum length of HTTP URIs passed to events. Longer ones will be truncated
   to prevent over-long URIs (usually sent by worms) from slowing down event
   processing.  A value of -1 means "do not truncate".

   .. zeek:see:: http_request

.. zeek:id:: udp_content_deliver_all_orig
   :source-code: base/init-bare.zeek 1946 1946

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, all UDP originator-side traffic is reported via
   :zeek:see:`udp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp tcp_content_deliver_all_resp
      tcp_content_delivery_ports_orig udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_resp
      udp_contents
      udp_content_delivery_ports_use_resp

.. zeek:id:: udp_content_deliver_all_resp
   :source-code: base/init-bare.zeek 1957 1957

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``F``

   If true, all UDP responder-side traffic is reported via
   :zeek:see:`udp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp tcp_content_deliver_all_resp
      tcp_content_delivery_ports_orig udp_content_delivery_ports_orig
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_contents
      udp_content_delivery_ports_use_resp

.. zeek:id:: udp_content_delivery_ports_orig
   :source-code: base/init-bare.zeek 1908 1908

   :Type: :zeek:type:`table` [:zeek:type:`port`] of :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Defines UDP destination ports for which the contents of the originator stream
   should be delivered via :zeek:see:`udp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp
      tcp_content_deliver_all_orig tcp_content_deliver_all_resp
      udp_content_delivery_ports_resp  udp_content_deliver_all_orig
      udp_content_deliver_all_resp  udp_contents
      udp_content_delivery_ports_use_resp udp_content_ports

.. zeek:id:: udp_content_delivery_ports_resp
   :source-code: base/init-bare.zeek 1918 1918

   :Type: :zeek:type:`table` [:zeek:type:`port`] of :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Defines UDP destination ports for which the contents of the responder stream
   should be delivered via :zeek:see:`udp_contents`.

   .. zeek:see:: tcp_content_delivery_ports_orig
      tcp_content_delivery_ports_resp tcp_content_deliver_all_orig
      tcp_content_deliver_all_resp udp_content_delivery_ports_orig
      udp_content_deliver_all_orig udp_content_deliver_all_resp udp_contents
      udp_content_delivery_ports_use_resp udp_content_ports

.. zeek:id:: udp_inactivity_timeout
   :source-code: base/init-bare.zeek 1797 1797

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 min``

   If a UDP flow is inactive, time it out after this interval. If 0 secs, then
   don't time it out.

   .. zeek:see:: tcp_inactivity_timeout icmp_inactivity_timeout unknown_ip_inactivity_timeout set_inactivity_timeout

.. zeek:id:: unknown_ip_inactivity_timeout
   :source-code: base/init-bare.zeek 1809 1809

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1.0 min``

   If a flow with an unknown IP-based protocol is inactive, time it out after
   this interval. If 0 secs, then don't time it out.

   .. zeek:see:: tcp_inactivity_timeout udp_inactivity_timeout icmp_inactivity_timeout set_inactivity_timeout

.. zeek:id:: use_conn_size_analyzer
   :source-code: base/init-bare.zeek 1998 1998

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``

   Whether to use the ``ConnSize`` analyzer to count the number of packets and
   IP-level bytes transferred by each endpoint. If true, these values are
   returned in the connection's :zeek:see:`endpoint` record value.

.. zeek:id:: watchdog_interval
   :source-code: base/init-bare.zeek 2787 2787

   :Type: :zeek:type:`interval`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``10.0 secs``

   Zeek's watchdog interval.

Constants
#########
.. zeek:id:: CONTENTS_BOTH
   :source-code: base/init-bare.zeek 2011 2011

   :Type: :zeek:type:`count`
   :Default: ``3``

   Record both originator and responder contents.

.. zeek:id:: CONTENTS_NONE
   :source-code: base/init-bare.zeek 2008 2008

   :Type: :zeek:type:`count`
   :Default: ``0``

   Turn off recording of contents.

.. zeek:id:: CONTENTS_ORIG
   :source-code: base/init-bare.zeek 2009 2009

   :Type: :zeek:type:`count`
   :Default: ``1``

   Record originator contents.

.. zeek:id:: CONTENTS_RESP
   :source-code: base/init-bare.zeek 2010 2010

   :Type: :zeek:type:`count`
   :Default: ``2``

   Record responder contents.

.. zeek:id:: DNS_ADDL
   :source-code: base/init-bare.zeek 3270 3270

   :Type: :zeek:type:`count`
   :Default: ``3``

   An additional record.

.. zeek:id:: DNS_ANS
   :source-code: base/init-bare.zeek 3268 3268

   :Type: :zeek:type:`count`
   :Default: ``1``

   An answer record.

.. zeek:id:: DNS_AUTH
   :source-code: base/init-bare.zeek 3269 3269

   :Type: :zeek:type:`count`
   :Default: ``2``

   An authoritative record.

.. zeek:id:: DNS_PREREQUISITE
   :source-code: base/init-bare.zeek 3271 3271

   :Type: :zeek:type:`count`
   :Default: ``4``

   A prerequisite record for dynamic update.

.. zeek:id:: DNS_QUERY
   :source-code: base/init-bare.zeek 3267 3267

   :Type: :zeek:type:`count`
   :Default: ``0``

   A query. This shouldn't occur, just for completeness.

.. zeek:id:: DNS_UPDATE
   :source-code: base/init-bare.zeek 3272 3272

   :Type: :zeek:type:`count`
   :Default: ``5``

   A update record for dynamic update.

.. zeek:id:: ENDIAN_BIG
   :source-code: base/init-bare.zeek 2003 2003

   :Type: :zeek:type:`count`
   :Default: ``2``

   Big endian.

.. zeek:id:: ENDIAN_CONFUSED
   :source-code: base/init-bare.zeek 2004 2004

   :Type: :zeek:type:`count`
   :Default: ``3``

   Tried to determine endian, but failed.

.. zeek:id:: ENDIAN_LITTLE
   :source-code: base/init-bare.zeek 2002 2002

   :Type: :zeek:type:`count`
   :Default: ``1``

   Little endian.

.. zeek:id:: ENDIAN_UNKNOWN
   :source-code: base/init-bare.zeek 2001 2001

   :Type: :zeek:type:`count`
   :Default: ``0``

   Endian not yet determined.

.. zeek:id:: ICMP_UNREACH_ADMIN_PROHIB
   :source-code: base/init-bare.zeek 2022 2022

   :Type: :zeek:type:`count`
   :Default: ``13``

   Administratively prohibited.

.. zeek:id:: ICMP_UNREACH_HOST
   :source-code: base/init-bare.zeek 2018 2018

   :Type: :zeek:type:`count`
   :Default: ``1``

   Host unreachable.

.. zeek:id:: ICMP_UNREACH_NEEDFRAG
   :source-code: base/init-bare.zeek 2021 2021

   :Type: :zeek:type:`count`
   :Default: ``4``

   Fragment needed.

.. zeek:id:: ICMP_UNREACH_NET
   :source-code: base/init-bare.zeek 2017 2017

   :Type: :zeek:type:`count`
   :Default: ``0``

   Network unreachable.

.. zeek:id:: ICMP_UNREACH_PORT
   :source-code: base/init-bare.zeek 2020 2020

   :Type: :zeek:type:`count`
   :Default: ``3``

   Port unreachable.

.. zeek:id:: ICMP_UNREACH_PROTOCOL
   :source-code: base/init-bare.zeek 2019 2019

   :Type: :zeek:type:`count`
   :Default: ``2``

   Protocol unreachable.

.. zeek:id:: IPPROTO_AH
   :source-code: base/init-bare.zeek 2042 2042

   :Type: :zeek:type:`count`
   :Default: ``51``

   IPv6 authentication header.

.. zeek:id:: IPPROTO_DSTOPTS
   :source-code: base/init-bare.zeek 2044 2044

   :Type: :zeek:type:`count`
   :Default: ``60``

   IPv6 destination options header.

.. zeek:id:: IPPROTO_ESP
   :source-code: base/init-bare.zeek 2041 2041

   :Type: :zeek:type:`count`
   :Default: ``50``

   IPv6 encapsulating security payload header.

.. zeek:id:: IPPROTO_FRAGMENT
   :source-code: base/init-bare.zeek 2040 2040

   :Type: :zeek:type:`count`
   :Default: ``44``

   IPv6 fragment header.

.. zeek:id:: IPPROTO_HOPOPTS
   :source-code: base/init-bare.zeek 2038 2038

   :Type: :zeek:type:`count`
   :Default: ``0``

   IPv6 hop-by-hop-options header.

.. zeek:id:: IPPROTO_ICMP
   :source-code: base/init-bare.zeek 2028 2028

   :Type: :zeek:type:`count`
   :Default: ``1``

   Control message protocol.

.. zeek:id:: IPPROTO_ICMPV6
   :source-code: base/init-bare.zeek 2034 2034

   :Type: :zeek:type:`count`
   :Default: ``58``

   ICMP for IPv6.

.. zeek:id:: IPPROTO_IGMP
   :source-code: base/init-bare.zeek 2029 2029

   :Type: :zeek:type:`count`
   :Default: ``2``

   Group management protocol.

.. zeek:id:: IPPROTO_IP
   :source-code: base/init-bare.zeek 2027 2027

   :Type: :zeek:type:`count`
   :Default: ``0``

   Dummy for IP.

.. zeek:id:: IPPROTO_IPIP
   :source-code: base/init-bare.zeek 2030 2030

   :Type: :zeek:type:`count`
   :Default: ``4``

   IP encapsulation in IP.

.. zeek:id:: IPPROTO_IPV6
   :source-code: base/init-bare.zeek 2033 2033

   :Type: :zeek:type:`count`
   :Default: ``41``

   IPv6 header.

.. zeek:id:: IPPROTO_MOBILITY
   :source-code: base/init-bare.zeek 2045 2045

   :Type: :zeek:type:`count`
   :Default: ``135``

   IPv6 mobility header.

.. zeek:id:: IPPROTO_NONE
   :source-code: base/init-bare.zeek 2043 2043

   :Type: :zeek:type:`count`
   :Default: ``59``

   IPv6 no next header.

.. zeek:id:: IPPROTO_RAW
   :source-code: base/init-bare.zeek 2035 2035

   :Type: :zeek:type:`count`
   :Default: ``255``

   Raw IP packet.

.. zeek:id:: IPPROTO_ROUTING
   :source-code: base/init-bare.zeek 2039 2039

   :Type: :zeek:type:`count`
   :Default: ``43``

   IPv6 routing header.

.. zeek:id:: IPPROTO_TCP
   :source-code: base/init-bare.zeek 2031 2031

   :Type: :zeek:type:`count`
   :Default: ``6``

   TCP.

.. zeek:id:: IPPROTO_UDP
   :source-code: base/init-bare.zeek 2032 2032

   :Type: :zeek:type:`count`
   :Default: ``17``

   User datagram protocol.

.. zeek:id:: LOGIN_STATE_AUTHENTICATE
   :source-code: base/init-bare.zeek 2800 2800

   :Type: :zeek:type:`count`
   :Default: ``0``


.. zeek:id:: LOGIN_STATE_CONFUSED
   :source-code: base/init-bare.zeek 2803 2803

   :Type: :zeek:type:`count`
   :Default: ``3``


.. zeek:id:: LOGIN_STATE_LOGGED_IN
   :source-code: base/init-bare.zeek 2801 2801

   :Type: :zeek:type:`count`
   :Default: ``1``


.. zeek:id:: LOGIN_STATE_SKIP
   :source-code: base/init-bare.zeek 2802 2802

   :Type: :zeek:type:`count`
   :Default: ``2``


.. zeek:id:: RPC_status
   :source-code: base/init-bare.zeek 2949 2949

   :Type: :zeek:type:`table` [:zeek:type:`rpc_status`] of :zeek:type:`string`
   :Default:

      ::

         {
            [RPC_PROG_MISMATCH] = "mismatch",
            [RPC_AUTH_ERROR] = "auth error",
            [RPC_SYSTEM_ERR] = "system err",
            [RPC_PROC_UNAVAIL] = "proc unavail",
            [RPC_SUCCESS] = "ok",
            [RPC_UNKNOWN_ERROR] = "unknown",
            [RPC_TIMEOUT] = "timeout",
            [RPC_GARBAGE_ARGS] = "garbage args",
            [RPC_PROG_UNAVAIL] = "prog unavail"
         }


   Mapping of numerical RPC status codes to readable messages.

   .. zeek:see:: pm_attempt_callit pm_attempt_dump pm_attempt_getport
      pm_attempt_null pm_attempt_set pm_attempt_unset rpc_dialogue rpc_reply

.. zeek:id:: SNMP::OBJ_COUNTER32_TAG
   :source-code: base/init-bare.zeek 5608 5608

   :Type: :zeek:type:`count`
   :Default: ``65``

   Unsigned 32-bit integer.

.. zeek:id:: SNMP::OBJ_COUNTER64_TAG
   :source-code: base/init-bare.zeek 5612 5612

   :Type: :zeek:type:`count`
   :Default: ``70``

   Unsigned 64-bit integer.

.. zeek:id:: SNMP::OBJ_ENDOFMIBVIEW_TAG
   :source-code: base/init-bare.zeek 5615 5615

   :Type: :zeek:type:`count`
   :Default: ``130``

   A NULL value.

.. zeek:id:: SNMP::OBJ_INTEGER_TAG
   :source-code: base/init-bare.zeek 5603 5603

   :Type: :zeek:type:`count`
   :Default: ``2``

   Signed 64-bit integer.

.. zeek:id:: SNMP::OBJ_IPADDRESS_TAG
   :source-code: base/init-bare.zeek 5607 5607

   :Type: :zeek:type:`count`
   :Default: ``64``

   An IP address.

.. zeek:id:: SNMP::OBJ_NOSUCHINSTANCE_TAG
   :source-code: base/init-bare.zeek 5614 5614

   :Type: :zeek:type:`count`
   :Default: ``129``

   A NULL value.

.. zeek:id:: SNMP::OBJ_NOSUCHOBJECT_TAG
   :source-code: base/init-bare.zeek 5613 5613

   :Type: :zeek:type:`count`
   :Default: ``128``

   A NULL value.

.. zeek:id:: SNMP::OBJ_OCTETSTRING_TAG
   :source-code: base/init-bare.zeek 5604 5604

   :Type: :zeek:type:`count`
   :Default: ``4``

   An octet string.

.. zeek:id:: SNMP::OBJ_OID_TAG
   :source-code: base/init-bare.zeek 5606 5606

   :Type: :zeek:type:`count`
   :Default: ``6``

   An Object Identifier.

.. zeek:id:: SNMP::OBJ_OPAQUE_TAG
   :source-code: base/init-bare.zeek 5611 5611

   :Type: :zeek:type:`count`
   :Default: ``68``

   An octet string.

.. zeek:id:: SNMP::OBJ_TIMETICKS_TAG
   :source-code: base/init-bare.zeek 5610 5610

   :Type: :zeek:type:`count`
   :Default: ``67``

   Unsigned 32-bit integer.

.. zeek:id:: SNMP::OBJ_UNSIGNED32_TAG
   :source-code: base/init-bare.zeek 5609 5609

   :Type: :zeek:type:`count`
   :Default: ``66``

   Unsigned 32-bit integer.

.. zeek:id:: SNMP::OBJ_UNSPECIFIED_TAG
   :source-code: base/init-bare.zeek 5605 5605

   :Type: :zeek:type:`count`
   :Default: ``5``

   A NULL value.

.. zeek:id:: TCP_CLOSED
   :source-code: base/init-bare.zeek 1713 1713

   :Type: :zeek:type:`count`
   :Default: ``5``

   Endpoint has closed connection.

.. zeek:id:: TCP_ESTABLISHED
   :source-code: base/init-bare.zeek 1712 1712

   :Type: :zeek:type:`count`
   :Default: ``4``

   Endpoint has finished initial handshake regularly.

.. zeek:id:: TCP_INACTIVE
   :source-code: base/init-bare.zeek 1708 1708

   :Type: :zeek:type:`count`
   :Default: ``0``

   Error string if unsuccessful.
   Endpoint is still inactive.

.. zeek:id:: TCP_PARTIAL
   :source-code: base/init-bare.zeek 1711 1711

   :Type: :zeek:type:`count`
   :Default: ``3``

   Endpoint has sent data but no initial SYN.

.. zeek:id:: TCP_RESET
   :source-code: base/init-bare.zeek 1714 1714

   :Type: :zeek:type:`count`
   :Default: ``6``

   Endpoint has sent RST.

.. zeek:id:: TCP_SYN_ACK_SENT
   :source-code: base/init-bare.zeek 1710 1710

   :Type: :zeek:type:`count`
   :Default: ``2``

   Endpoint has sent SYN/ACK.

.. zeek:id:: TCP_SYN_SENT
   :source-code: base/init-bare.zeek 1709 1709

   :Type: :zeek:type:`count`
   :Default: ``1``

   Endpoint has sent SYN.

.. zeek:id:: TH_ACK
   :source-code: base/init-bare.zeek 2373 2373

   :Type: :zeek:type:`count`
   :Default: ``16``

   ACK.

.. zeek:id:: TH_FIN
   :source-code: base/init-bare.zeek 2369 2369

   :Type: :zeek:type:`count`
   :Default: ``1``

   FIN.

.. zeek:id:: TH_FLAGS
   :source-code: base/init-bare.zeek 2375 2375

   :Type: :zeek:type:`count`
   :Default: ``63``

   Mask combining all flags.

.. zeek:id:: TH_PUSH
   :source-code: base/init-bare.zeek 2372 2372

   :Type: :zeek:type:`count`
   :Default: ``8``

   PUSH.

.. zeek:id:: TH_RST
   :source-code: base/init-bare.zeek 2371 2371

   :Type: :zeek:type:`count`
   :Default: ``4``

   RST.

.. zeek:id:: TH_SYN
   :source-code: base/init-bare.zeek 2370 2370

   :Type: :zeek:type:`count`
   :Default: ``2``

   SYN.

.. zeek:id:: TH_URG
   :source-code: base/init-bare.zeek 2374 2374

   :Type: :zeek:type:`count`
   :Default: ``32``

   URG.

.. zeek:id:: UDP_ACTIVE
   :source-code: base/init-bare.zeek 1719 1719

   :Type: :zeek:type:`count`
   :Default: ``1``

   Endpoint has sent something.

.. zeek:id:: UDP_INACTIVE
   :source-code: base/init-bare.zeek 1718 1718

   :Type: :zeek:type:`count`
   :Default: ``0``

   Endpoint is still inactive.

.. zeek:id:: trace_output_file
   :source-code: base/init-bare.zeek 558 558

   :Type: :zeek:type:`string`
   :Default: ``""``

   Holds the filename of the trace file given with ``-w`` (empty if none).

   .. zeek:see:: record_all_packets

.. zeek:id:: zeek_script_args
   :source-code: base/init-bare.zeek 438 438

   :Type: :zeek:type:`vector` of :zeek:type:`string`
   :Default:

      ::

         []


   Arguments given to Zeek from the command line. In order to use this, Zeek
   must use a ``--`` command line argument immediately followed by a script
   file and additional arguments after that. For example::

     zeek --bare-mode -- myscript.zeek -a -b -c

   To use Zeek as an executable interpreter, include a line at the top of a script
   like the following and make the script executable::

     #!/usr/local/zeek/bin/zeek --

State Variables
###############
.. zeek:id:: capture_filters
   :source-code: base/init-bare.zeek 1527 1527

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Set of BPF capture filters to use for capturing, indexed by a user-definable
   ID (which must be unique). If Zeek is *not* configured with
   :zeek:id:`PacketFilter::enable_auto_protocol_capture_filters`,
   all packets matching at least one of the filters in this table (and all in
   :zeek:id:`restrict_filters`) will be analyzed.

   .. zeek:see:: PacketFilter PacketFilter::enable_auto_protocol_capture_filters
      PacketFilter::unrestricted_filter restrict_filters

.. zeek:id:: direct_login_prompts
   :source-code: base/init-bare.zeek 2860 2860

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: discarder_maxlen
   :source-code: base/init-bare.zeek 2716 2716

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``128``

   Maximum length of payload passed to discarder functions.

   .. zeek:see:: discarder_check_tcp discarder_check_udp discarder_check_icmp
      discarder_check_ip

.. zeek:id:: dns_max_compression_chain_depth
   :source-code: base/init-bare.zeek 3317 3317

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``20``

   The maximum depth of a compression chain in DNS. If this limit is reached, a weird is
   reported and parsing of the chain is halted. See :rfc:`1035#section-4.1.4`.

.. zeek:id:: dns_max_queries
   :source-code: base/init-bare.zeek 3313 3313

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``25``

   If a DNS request includes more than this many queries, assume it's non-DNS
   traffic and do not process it.  Set to 0 to turn off this functionality.

.. zeek:id:: dns_skip_addl
   :source-code: base/init-bare.zeek 3299 3299

   :Type: :zeek:type:`set` [:zeek:type:`addr`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   For DNS servers in these sets, omit processing the ADDL records they include
   in their replies.

   .. zeek:see:: dns_skip_all_addl dns_skip_auth

.. zeek:id:: dns_skip_all_addl
   :source-code: base/init-bare.zeek 3309 3309

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``
   :Redefinition: from :doc:`/scripts/policy/protocols/dns/auth-addl.zeek`

      ``=``::

         ``F``


   If true, all DNS ADDL records are skipped.

   .. zeek:see:: dns_skip_all_auth dns_skip_addl

.. zeek:id:: dns_skip_all_auth
   :source-code: base/init-bare.zeek 3304 3304

   :Type: :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``T``
   :Redefinition: from :doc:`/scripts/policy/protocols/dns/auth-addl.zeek`

      ``=``::

         ``F``


   If true, all DNS AUTH records are skipped.

   .. zeek:see:: dns_skip_all_addl dns_skip_auth

.. zeek:id:: dns_skip_auth
   :source-code: base/init-bare.zeek 3293 3293

   :Type: :zeek:type:`set` [:zeek:type:`addr`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   For DNS servers in these sets, omit processing the AUTH records they include
   in their replies.

   .. zeek:see:: dns_skip_all_auth dns_skip_addl

.. zeek:id:: done_with_network
   :source-code: base/init-bare.zeek 6886 6886

   :Type: :zeek:type:`bool`
   :Default: ``F``


.. zeek:id:: http_entity_data_delivery_size
   :source-code: base/init-bare.zeek 3350 3350

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1500``

   Maximum number of HTTP entity data delivered to events.

   .. zeek:see:: http_entity_data skip_http_entity_data skip_http_data

.. zeek:id:: interfaces
   :source-code: base/init-bare.zeek 2689 2689

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&add_func` = :zeek:see:`add_interface` :zeek:attr:`&redef`
   :Default: ``""``

   Network interfaces to listen on. Use ``redef interfaces += "eth0"`` to
   extend.

.. zeek:id:: login_failure_msgs
   :source-code: base/init-bare.zeek 2869 2869

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: login_non_failure_msgs
   :source-code: base/init-bare.zeek 2866 2866

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: login_prompts
   :source-code: base/init-bare.zeek 2863 2863

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: login_success_msgs
   :source-code: base/init-bare.zeek 2872 2872

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: login_timeouts
   :source-code: base/init-bare.zeek 2875 2875

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

.. zeek:id:: mime_segment_length
   :source-code: base/init-bare.zeek 2895 2895

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``1024``

   The length of MIME data segments delivered to handlers of
   :zeek:see:`mime_segment_data`.

   .. zeek:see:: mime_segment_data mime_segment_overlap_length

.. zeek:id:: mime_segment_overlap_length
   :source-code: base/init-bare.zeek 2899 2899

   :Type: :zeek:type:`count`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``0``

   The number of bytes of overlap between successive segments passed to
   :zeek:see:`mime_segment_data`.

.. zeek:id:: pkt_profile_file
   :source-code: base/init-bare.zeek 3002 3002

   :Type: :zeek:type:`file`
   :Attributes: :zeek:attr:`&redef`

   File where packet profiles are logged.

   .. zeek:see:: pkt_profile_modes pkt_profile_freq pkt_profile_mode

.. zeek:id:: profiling_file
   :source-code: base/init-bare.zeek 2965 2965

   :Type: :zeek:type:`file`
   :Attributes: :zeek:attr:`&redef`
   :Default:

      ::

         file "prof.log" of string

   :Redefinition: from :doc:`/scripts/policy/misc/profiling.zeek`

      ``=``::

         open(fmt(prof.%s, Profiling::log_suffix()))


   Write profiling info into this file in regular intervals. The easiest way to
   activate profiling is loading :doc:`/scripts/policy/misc/profiling.zeek`.

   .. zeek:see:: profiling_interval expensive_profiling_multiple

.. zeek:id:: restrict_filters
   :source-code: base/init-bare.zeek 1534 1534

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`string`
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Set of BPF filters to restrict capturing, indexed by a user-definable ID
   (which must be unique).

   .. zeek:see:: PacketFilter PacketFilter::enable_auto_protocol_capture_filters
      PacketFilter::unrestricted_filter capture_filters

.. zeek:id:: secondary_filters
   :source-code: base/init-bare.zeek 2709 2709

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`event` (filter: :zeek:type:`string`, pkt: :zeek:type:`pkt_hdr`)
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   Definition of "secondary filters". A secondary filter is a BPF filter given
   as index in this table. For each such filter, the corresponding event is
   raised for all matching packets.

.. zeek:id:: signature_files
   :source-code: base/init-bare.zeek 2704 2704

   :Type: :zeek:type:`string`
   :Attributes: :zeek:attr:`&add_func` = :zeek:see:`add_signature_file` :zeek:attr:`&redef`
   :Default: ``""``

   Signature files to read. Use ``redef signature_files  += "foo.sig"`` to
   extend. Signature files added this way will be searched relative to
   ``ZEEKPATH``.  Using the ``@load-sigs`` directive instead is preferred
   since that can search paths relative to the current script.

.. zeek:id:: skip_authentication
   :source-code: base/init-bare.zeek 2857 2857

   :Type: :zeek:type:`set` [:zeek:type:`string`]
   :Attributes: :zeek:attr:`&redef`
   :Default: ``{}``

   TODO.

Types
#####
.. zeek:type:: Analyzer::disabling_analyzer
   :source-code: policy/frameworks/analyzer/debug-logging.zeek 192 207

   :Type: :zeek:type:`hook` (c: :zeek:type:`connection`, atype: :zeek:type:`AllAnalyzers::Tag`, aid: :zeek:type:`count`) : :zeek:type:`bool`
   :Attributes: :zeek:attr:`&redef`

   A hook taking a connection, analyzer tag and analyzer id that can be
   used to veto disabling protocol analyzers. Specifically, an analyzer
   can be prevented from being disabled by using a :zeek:see:`break`
   statement within the hook.
   This hook is invoked synchronously during a :zeek:see:`disable_analyzer` call.

   Scripts implementing this hook should have other logic that will eventually
   disable the analyzer for the given connection. That is, if a script vetoes
   disabling an analyzer, it takes responsibility for a later call to
   :zeek:see:`disable_analyzer`, which may be never.


   :param c: The connection


   :param atype: The type / tag of the analyzer being disabled.


   :param aid: The analyzer ID.

.. zeek:type:: AnalyzerConfirmationInfo
   :source-code: base/init-bare.zeek 1106 1120

   :Type: :zeek:type:`record`


   .. zeek:field:: c :zeek:type:`connection` :zeek:attr:`&optional`

      The connection related to this confirmation, if any.
      This field may be set if there's any connection related information
      available for this confirmation. For protocol analyzers it is guaranteed
      to be set, but may also be added by file analyzers as additional
      contextual information.


   .. zeek:field:: f :zeek:type:`fa_file` :zeek:attr:`&optional`

      The file object related to this confirmation, if any.


   .. zeek:field:: aid :zeek:type:`count` :zeek:attr:`&optional`

      Specific analyzer instance that can be used to reference the analyzer
      when using builtin functions like :zeek:id:`disable_analyzer`.


   Generic analyzer confirmation info record.

   .. zeek:see:: analyzer_confirmation_info

.. zeek:type:: AnalyzerViolationInfo
   :source-code: base/init-bare.zeek 1125 1145

   :Type: :zeek:type:`record`


   .. zeek:field:: reason :zeek:type:`string`

      The reason for the violation - should be user readable.


   .. zeek:field:: c :zeek:type:`connection` :zeek:attr:`&optional`

      The connection related to this violation, if any.
      This field may be set if there's any connection related information
      available for this violation. For protocol analyzers it is guaranteed
      to be set, but may also be added by file analyzers as additional
      contextual information.


   .. zeek:field:: f :zeek:type:`fa_file` :zeek:attr:`&optional`

      The file object related to this violation, if any.


   .. zeek:field:: aid :zeek:type:`count` :zeek:attr:`&optional`

      Specific analyzer instance that can be used to reference the analyzer
      when using builtin functions like :zeek:id:`disable_analyzer`.


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      Piece of binary data that was parsed and caused the violation.


   Generic analyzer violation info record.

   .. zeek:see:: analyzer_violation_info

.. zeek:type:: Backtrace
   :source-code: base/init-bare.zeek 1472 1472

   :Type: :zeek:type:`vector` of :zeek:type:`BacktraceElement`

   A representation of a Zeek script's call stack.

   .. zeek:see:: backtrace print_backtrace

.. zeek:type:: BacktraceElement
   :source-code: base/init-bare.zeek 1458 1467

   :Type: :zeek:type:`record`


   .. zeek:field:: function_name :zeek:type:`string`

      The name of the function being called at this point in the call stack.


   .. zeek:field:: function_args :zeek:type:`call_argument_vector`

      The arguments passed to the function being called.


   .. zeek:field:: file_location :zeek:type:`string` :zeek:attr:`&optional`

      The file in which the function call is being made.


   .. zeek:field:: line_location :zeek:type:`count` :zeek:attr:`&optional`

      The line number at which the function call is being made.


   A representation of an element in a Zeek script's call stack.

   .. zeek:see:: backtrace print_backtrace

.. zeek:type:: BrokerPeeringStats
   :source-code: base/init-bare.zeek 1338 1346

   :Type: :zeek:type:`record`


   .. zeek:field:: num_queued :zeek:type:`count`

      The number of messages currently queued locally for transmission.


   .. zeek:field:: max_queued_recently :zeek:type:`count`

      The maximum number of messages queued in the recent
      :zeek:see:`Broker::buffer_stats_reset_interval` time interval.


   .. zeek:field:: num_overflows :zeek:type:`count`

      The number of times the send buffer has overflowed.


   Broker statistics for an individual peering.


.. zeek:type:: BrokerPeeringStatsTable
   :source-code: base/init-bare.zeek 1348 1348

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`BrokerPeeringStats`


.. zeek:type:: BrokerStats
   :source-code: base/init-bare.zeek 1316 1334

   :Type: :zeek:type:`record`


   .. zeek:field:: num_peers :zeek:type:`count`


   .. zeek:field:: num_stores :zeek:type:`count`

      Number of active data stores.


   .. zeek:field:: num_pending_queries :zeek:type:`count`

      Number of pending data store queries.


   .. zeek:field:: num_events_incoming :zeek:type:`count`

      Number of total log messages received.


   .. zeek:field:: num_events_outgoing :zeek:type:`count`

      Number of total log messages sent.


   .. zeek:field:: num_logs_incoming :zeek:type:`count`

      Number of total log records received.


   .. zeek:field:: num_logs_outgoing :zeek:type:`count`

      Number of total log records sent.


   .. zeek:field:: num_ids_incoming :zeek:type:`count`

      Number of total identifiers received.


   .. zeek:field:: num_ids_outgoing :zeek:type:`count`

      Number of total identifiers sent.


   Statistics about Broker communication.

   .. zeek:see:: get_broker_stats

.. zeek:type:: Cluster::Pool
   :source-code: base/frameworks/cluster/pools.zeek 46 61

   :Type: :zeek:type:`record`


   .. zeek:field:: spec :zeek:type:`Cluster::PoolSpec`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      The specification of the pool that was used when registering it.


   .. zeek:field:: nodes :zeek:type:`Cluster::PoolNodeTable` :zeek:attr:`&default` = ``{  }`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      Nodes in the pool, indexed by their name (e.g. "manager").


   .. zeek:field:: node_list :zeek:type:`vector` of :zeek:type:`Cluster::PoolNode` :zeek:attr:`&default` = ``[]`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      A list of nodes in the pool in a deterministic order.


   .. zeek:field:: hrw_pool :zeek:type:`HashHRW::Pool` :zeek:attr:`&default` = ``[sites={  }]`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      The Rendezvous hashing structure.


   .. zeek:field:: rr_key_seq :zeek:type:`Cluster::RoundRobinTable` :zeek:attr:`&default` = ``{  }`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      Round-Robin table indexed by arbitrary key and storing the next
      index of *node_list* that will be eligible to receive work (if it's
      alive at the time of next request).


   .. zeek:field:: alive_count :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/cluster/pools.zeek` is loaded)

      Number of pool nodes that are currently alive.


   A pool used for distributing data/work among a set of cluster nodes.

.. zeek:type:: Cluster::PublishOnChangeAttr
   :source-code: base/init-bare.zeek 6330 6342

   :Type: :zeek:type:`record`


   .. zeek:field:: changes :zeek:type:`set` [:zeek:type:`TableChange`]

      Which changes to publish. Cannot be empty.


   .. zeek:field:: topic :zeek:type:`any` :zeek:attr:`&optional`

      Either a string or a function returning a string with function parameters
      matching the index types of the :zeek:type:`table` or :zeek:type:`set`.


   .. zeek:field:: max_batch_size :zeek:type:`count` :zeek:attr:`&default` = :zeek:see:`Cluster::default_table_publish_on_change_max_batch_size` :zeek:attr:`&optional`

      Maximum number of changes to queue into a batch before publishing.
      Setting this value to 0 disables batching behavior.


   .. zeek:field:: max_batch_delay :zeek:type:`interval` :zeek:attr:`&default` = :zeek:see:`Cluster::default_table_publish_on_change_max_batch_delay` :zeek:attr:`&optional`

      Maximum interval to delay the publish.
      Setting this value to 0sec disables batching behavior.


   The record type used for the :zeek:attr:`&publish_on_change` attribute.

.. zeek:type:: Cluster::TableChangeHeader
   :source-code: base/init-bare.zeek 6369 6376

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`string`

      The script-layer identifier of this table.


   .. zeek:field:: ts :zeek:type:`time`

      The network timestamp when this event was published.


   .. zeek:field:: node_id :zeek:type:`string`

      The :zeek:see:`Cluster::node_id` value of the sending process.


   Record passed as "header" into the :zeek:see:`Cluster::table_change_infos`
   event that holds common information applying to all of the individual
   :zeek:see:`Cluster::TableChangeInfo` records.

.. zeek:type:: Cluster::TableChangeInfo
   :source-code: base/init-bare.zeek 6346 6361

   :Type: :zeek:type:`record`


   .. zeek:field:: change :zeek:type:`TableChange`

      The type of change.


   .. zeek:field:: ts :zeek:type:`time`

      The network time of this change.


   .. zeek:field:: index :zeek:type:`vector` of :zeek:type:`any`

      The index value. Internally tables and sets use ListVal
      instances, but for cluster communication we use vector
      of any.


   .. zeek:field:: value :zeek:type:`any` :zeek:attr:`&optional`

      The new, updated or removed value of the new element.
      Unused for sets.


   .. zeek:field:: previous_value :zeek:type:`any` :zeek:attr:`&optional`

      The previous value in the table when the change field
      is :zeek:see:`TABLE_ELEMENT_CHANGED`. Unused for sets.


   Record encapsulating a single table change / modification for
   distribution to other Zeek processes in a cluster.

.. zeek:type:: Cluster::TableChangeInfos
   :source-code: base/init-bare.zeek 6364 6364

   :Type: :zeek:type:`vector` of :zeek:type:`Cluster::TableChangeInfo`

   Vector of individual :zeek:see:`Cluster::TableChangeInfo` records.

.. zeek:type:: ConnStats
   :source-code: base/init-bare.zeek 1188 1211

   :Type: :zeek:type:`record`


   .. zeek:field:: total_conns :zeek:type:`count`




   .. zeek:field:: current_conns :zeek:type:`count`




   .. zeek:field:: sess_current_conns :zeek:type:`count`




   .. zeek:field:: num_packets :zeek:type:`count`


   .. zeek:field:: num_fragments :zeek:type:`count`


   .. zeek:field:: max_fragments :zeek:type:`count`


   .. zeek:field:: num_tcp_conns :zeek:type:`count`

      Current number of TCP connections in memory.


   .. zeek:field:: max_tcp_conns :zeek:type:`count`

      Maximum number of concurrent TCP connections so far.


   .. zeek:field:: cumulative_tcp_conns :zeek:type:`count`

      Total number of TCP connections so far.


   .. zeek:field:: num_udp_conns :zeek:type:`count`

      Current number of UDP flows in memory.


   .. zeek:field:: max_udp_conns :zeek:type:`count`

      Maximum number of concurrent UDP flows so far.


   .. zeek:field:: cumulative_udp_conns :zeek:type:`count`

      Total number of UDP flows so far.


   .. zeek:field:: num_icmp_conns :zeek:type:`count`

      Current number of ICMP flows in memory.


   .. zeek:field:: max_icmp_conns :zeek:type:`count`

      Maximum number of concurrent ICMP flows so far.


   .. zeek:field:: cumulative_icmp_conns :zeek:type:`count`

      Total number of ICMP flows so far.


   .. zeek:field:: num_packets_unprocessed :zeek:type:`count`

      Total number of packets not processed by any analyzer.


   .. zeek:field:: killed_by_inactivity :zeek:type:`count`



.. zeek:type:: DHCP::Addrs
   :source-code: base/init-bare.zeek 4987 4987

   :Type: :zeek:type:`vector` of :zeek:type:`addr`

   A list of addresses offered by a DHCP server.  Could be routers,
   DNS servers, or other.

   .. zeek:see:: dhcp_message

.. zeek:type:: DHCP::ClientFQDN
   :source-code: base/init-bare.zeek 5018 5028

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`count`

      An unparsed bitfield of flags (refer to RFC 4702).


   .. zeek:field:: rcode1 :zeek:type:`count`

      This field is deprecated in the standard.


   .. zeek:field:: rcode2 :zeek:type:`count`

      This field is deprecated in the standard.


   .. zeek:field:: domain_name :zeek:type:`string`

      The Domain Name part of the option carries all or part of the FQDN
      of a DHCP client.


   DHCP Client FQDN Option information (Option 81)

.. zeek:type:: DHCP::ClientID
   :source-code: base/init-bare.zeek 5012 5015

   :Type: :zeek:type:`record`


   .. zeek:field:: hwtype :zeek:type:`count`


   .. zeek:field:: hwaddr :zeek:type:`string`


   DHCP Client Identifier (Option 61)

   .. zeek:see:: dhcp_message

.. zeek:type:: DHCP::Msg
   :source-code: base/init-bare.zeek 4992 5007

   :Type: :zeek:type:`record`


   .. zeek:field:: op :zeek:type:`count`

      Message OP code. 1 = BOOTREQUEST, 2 = BOOTREPLY


   .. zeek:field:: m_type :zeek:type:`count`

      The type of DHCP message.


   .. zeek:field:: xid :zeek:type:`count`

      Transaction ID of a DHCP session.


   .. zeek:field:: secs :zeek:type:`interval`

      Number of seconds since client began address acquisition
      or renewal process


   .. zeek:field:: flags :zeek:type:`count`


   .. zeek:field:: ciaddr :zeek:type:`addr`

      Original IP address of the client.


   .. zeek:field:: yiaddr :zeek:type:`addr`

      IP address assigned to the client.


   .. zeek:field:: siaddr :zeek:type:`addr`

      IP address of the server.


   .. zeek:field:: giaddr :zeek:type:`addr`

      IP address of the relaying gateway.


   .. zeek:field:: chaddr :zeek:type:`string`

      Client hardware address.


   .. zeek:field:: sname :zeek:type:`string` :zeek:attr:`&default` = ``""`` :zeek:attr:`&optional`

      Server host name.


   .. zeek:field:: file_n :zeek:type:`string` :zeek:attr:`&default` = ``""`` :zeek:attr:`&optional`

      Boot file name.


   A DHCP message.

   .. zeek:see:: dhcp_message

.. zeek:type:: DHCP::Options
   :source-code: base/init-bare.zeek 5040 5138

   :Type: :zeek:type:`record`


   .. zeek:field:: options :zeek:type:`index_vec` :zeek:attr:`&optional`

      The ordered list of all DHCP option numbers.


   .. zeek:field:: subnet_mask :zeek:type:`addr` :zeek:attr:`&optional`

      Subnet Mask Value (option 1)


   .. zeek:field:: routers :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      Router addresses (option 3)


   .. zeek:field:: dns_servers :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      DNS Server addresses (option 6)


   .. zeek:field:: host_name :zeek:type:`string` :zeek:attr:`&optional`

      The Hostname of the client (option 12)


   .. zeek:field:: domain_name :zeek:type:`string` :zeek:attr:`&optional`

      The DNS domain name of the client (option 15)


   .. zeek:field:: forwarding :zeek:type:`bool` :zeek:attr:`&optional`

      Enable/Disable IP Forwarding (option 19)


   .. zeek:field:: broadcast :zeek:type:`addr` :zeek:attr:`&optional`

      Broadcast Address (option 28)


   .. zeek:field:: vendor :zeek:type:`string` :zeek:attr:`&optional`

      Vendor specific data. This can frequently
      be unparsed binary data. (option 43)


   .. zeek:field:: nbns :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      NETBIOS name server list (option 44)


   .. zeek:field:: addr_request :zeek:type:`addr` :zeek:attr:`&optional`

      Address requested by the client (option 50)


   .. zeek:field:: lease :zeek:type:`interval` :zeek:attr:`&optional`

      Lease time offered by the server. (option 51)


   .. zeek:field:: serv_addr :zeek:type:`addr` :zeek:attr:`&optional`

      Server address to allow clients to distinguish
      between lease offers. (option 54)


   .. zeek:field:: param_list :zeek:type:`index_vec` :zeek:attr:`&optional`

      DHCP Parameter Request list (option 55)


   .. zeek:field:: message :zeek:type:`string` :zeek:attr:`&optional`

      Textual error message (option 56)


   .. zeek:field:: max_msg_size :zeek:type:`count` :zeek:attr:`&optional`

      Maximum Message Size (option 57)


   .. zeek:field:: renewal_time :zeek:type:`interval` :zeek:attr:`&optional`

      This option specifies the time interval from address
      assignment until the client transitions to the
      RENEWING state. (option 58)


   .. zeek:field:: rebinding_time :zeek:type:`interval` :zeek:attr:`&optional`

      This option specifies the time interval from address
      assignment until the client transitions to the
      REBINDING state. (option 59)


   .. zeek:field:: vendor_class :zeek:type:`string` :zeek:attr:`&optional`

      This option is used by DHCP clients to optionally
      identify the vendor type and configuration of a DHCP
      client. (option 60)


   .. zeek:field:: client_id :zeek:type:`DHCP::ClientID` :zeek:attr:`&optional`

      DHCP Client Identifier (Option 61)


   .. zeek:field:: user_class :zeek:type:`string` :zeek:attr:`&optional`

      User Class opaque value (Option 77)


   .. zeek:field:: client_fqdn :zeek:type:`DHCP::ClientFQDN` :zeek:attr:`&optional`

      DHCP Client FQDN (Option 81)


   .. zeek:field:: sub_opt :zeek:type:`DHCP::SubOpts` :zeek:attr:`&optional`

      DHCP Relay Agent Information Option (Option 82)


   .. zeek:field:: auto_config :zeek:type:`bool` :zeek:attr:`&optional`

      Auto Config option to let host know if it's allowed to
      auto assign an IP address. (Option 116)


   .. zeek:field:: auto_proxy_config :zeek:type:`string` :zeek:attr:`&optional`

      URL to find a proxy.pac for auto proxy config (Option 252)


   .. zeek:field:: time_offset :zeek:type:`int` :zeek:attr:`&optional`

      The offset of the client's subnet in seconds from UTC. (Option 2)


   .. zeek:field:: time_servers :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      A list of :rfc:`868` time servers available to the client.
      (Option 4)


   .. zeek:field:: name_servers :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      A list of IEN 116 name servers available to the client. (Option 5)


   .. zeek:field:: ntp_servers :zeek:type:`DHCP::Addrs` :zeek:attr:`&optional`

      A list of IP addresses indicating NTP servers available to the
      client. (Option 42)



.. zeek:type:: DHCP::SubOpt
   :source-code: base/init-bare.zeek 5033 5036

   :Type: :zeek:type:`record`


   .. zeek:field:: code :zeek:type:`count`


   .. zeek:field:: value :zeek:type:`string`


   DHCP Relay Agent Information Option (Option 82)

   .. zeek:see:: dhcp_message

.. zeek:type:: DHCP::SubOpts
   :source-code: base/init-bare.zeek 5038 5038

   :Type: :zeek:type:`vector` of :zeek:type:`DHCP::SubOpt`


.. zeek:type:: DNSStats
   :source-code: base/init-bare.zeek 1285 1294

   :Type: :zeek:type:`record`


   .. zeek:field:: requests :zeek:type:`count`

      Number of DNS requests made


   .. zeek:field:: successful :zeek:type:`count`

      Number of successful DNS replies.


   .. zeek:field:: failed :zeek:type:`count`

      Number of DNS reply failures.


   .. zeek:field:: pending :zeek:type:`count`

      Current pending queries.


   .. zeek:field:: cached_hosts :zeek:type:`count`

      Number of cached hosts.


   .. zeek:field:: cached_addresses :zeek:type:`count`

      Number of cached addresses.


   .. zeek:field:: cached_texts :zeek:type:`count`

      Number of cached text entries.


   .. zeek:field:: cached_total :zeek:type:`count`

      Total number of cached entries.


   Statistics related to Zeek's active use of DNS.  These numbers are
   about Zeek performing DNS queries on it's own, not traffic
   being seen.

   .. zeek:see:: get_dns_stats

.. zeek:type:: EncapsulatingConnVector
   :source-code: base/init-bare.zeek 880 880

   :Type: :zeek:type:`vector` of :zeek:type:`Tunnel::EncapsulatingConn`

   A type alias for a vector of encapsulating "connections", i.e. for when
   there are tunnels within tunnels.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: EventMetadata::Entry
   :source-code: base/init-bare.zeek 647 650

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`EventMetadata::ID`

      The registered :zeek:see:`EventMetadata::ID` value.


   .. zeek:field:: val :zeek:type:`any`

      The value. Its type matches what was passed to :zeek:see:`EventMetadata::register`.


   A event metadata entry.

.. zeek:type:: EventMetadata::ID
   :source-code: base/init-bare.zeek 642 645

   :Type: :zeek:type:`enum`

      .. zeek:enum:: EventMetadata::NETWORK_TIMESTAMP EventMetadata::ID

   Enum type for metadata identifiers.

.. zeek:type:: EventNameCounter
   :source-code: base/init-bare.zeek 1364 1369

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string` :zeek:attr:`&log`

      Name of the zeek event.


   .. zeek:field:: times_called :zeek:type:`count` :zeek:attr:`&log`

      Times it was called, as counted by the event handlers.

   :Attributes: :zeek:attr:`&log`

   Statistics about how many times each event name is queued.

   .. zeek:see:: get_event_handler_stats

.. zeek:type:: EventNameStats
   :source-code: base/init-bare.zeek 1371 1371

   :Type: :zeek:type:`vector` of :zeek:type:`EventNameCounter`


.. zeek:type:: EventStats
   :source-code: base/init-bare.zeek 1234 1237

   :Type: :zeek:type:`record`


   .. zeek:field:: queued :zeek:type:`count`

      Total number of events queued so far.


   .. zeek:field:: dispatched :zeek:type:`count`

      Total number of events dispatched so far.



.. zeek:type:: FileAnalysisStats
   :source-code: base/init-bare.zeek 1274 1278

   :Type: :zeek:type:`record`


   .. zeek:field:: current :zeek:type:`count`

      Current number of files being analyzed.


   .. zeek:field:: max :zeek:type:`count`

      Maximum number of concurrent files so far.


   .. zeek:field:: cumulative :zeek:type:`count`

      Cumulative number of files analyzed.


   Statistics of file analysis.

   .. zeek:see:: get_file_analysis_stats

.. zeek:type:: GapStats
   :source-code: base/init-bare.zeek 1299 1304

   :Type: :zeek:type:`record`


   .. zeek:field:: ack_events :zeek:type:`count`

      How many ack events *could* have had gaps.


   .. zeek:field:: ack_bytes :zeek:type:`count`

      How many bytes those covered.


   .. zeek:field:: gap_events :zeek:type:`count`

      How many *did* have gaps.


   .. zeek:field:: gap_bytes :zeek:type:`count`

      How many bytes were missing in the gaps.


   Statistics about number of gaps in TCP connections.

   .. zeek:see:: get_gap_stats

.. zeek:type:: IPAddrAnonymization
   :source-code: base/init-bare.zeek 1541 1550

   :Type: :zeek:type:`enum`

      .. zeek:enum:: KEEP_ORIG_ADDR IPAddrAnonymization

      .. zeek:enum:: SEQUENTIALLY_NUMBERED IPAddrAnonymization

      .. zeek:enum:: PREFIX_PRESERVING_A50 IPAddrAnonymization

      .. zeek:enum:: RANDOM_MD5 IPAddrAnonymization

      .. zeek:enum:: PREFIX_PRESERVING_MD5 IPAddrAnonymization

      .. zeek:enum:: RANDOM_SHA256 IPAddrAnonymization

      .. zeek:enum:: PREFIX_PRESERVING_SHA256 IPAddrAnonymization

   .. zeek:see:: anonymize_addr

.. zeek:type:: IPAddrAnonymizationClass
   :source-code: base/init-bare.zeek 1552 1557

   :Type: :zeek:type:`enum`

      .. zeek:enum:: ORIG_ADDR IPAddrAnonymizationClass

      .. zeek:enum:: RESP_ADDR IPAddrAnonymizationClass

      .. zeek:enum:: OTHER_ADDR IPAddrAnonymizationClass

   .. zeek:see:: anonymize_addr

.. zeek:type:: JSON::StringEscapePolicy
   :source-code: base/init-bare.zeek 5878 5898

   :Type: :zeek:type:`enum`

      .. zeek:enum:: JSON::STRING_ESCAPE_POLICY_HEX JSON::StringEscapePolicy

         By default, Zeek escapes bytes of non-UTF8 sequences as \\xXX
         without backslash escaping, resulting in non-reversible encodings.
         Byte \x07 becomes \\x07 and literal string \x07 also becomes \\x07
         in the resulting JSON string.

      .. zeek:enum:: JSON::STRING_ESCAPE_POLICY_PUA JSON::StringEscapePolicy

         All control characters and non-printable bytes not part of valid UTF-8
         sequences are mapped into Unicode Supplementary Private Use Area-A
         (U+F0000..U+FFFFF) and encoded as surrogate pair:
         In a JSON string, the byte value \x07 will become "\udb80\udc07".
         The literal string \x07 will become "\\x07".

      .. zeek:enum:: JSON::STRING_ESCAPE_POLICY_TSV JSON::StringEscapePolicy

         Strings are first escaped as in TSV logs: all control characters
         and non-printable bytes not part of valid UTF-8 sequences are ``\xXX`` escaped.
         Lone backslashes are backslash escaped. Then, standard JSON escaping is applied,
         escaping all backslashes again.
         Byte \x07 becomes \\x07 and literal string \x07 becomes \\\\x07
         in the resulting JSON string.

   Escaping policy for non-printable non-UTF8 sequences.

.. zeek:type:: JSON::TimestampFormat
   :source-code: base/init-bare.zeek 5856 5876

   :Type: :zeek:type:`enum`

      .. zeek:enum:: JSON::TS_EPOCH JSON::TimestampFormat

         Timestamps will be formatted as UNIX epoch doubles.  This is
         the format that Zeek typically writes out timestamps.

      .. zeek:enum:: JSON::TS_MILLIS JSON::TimestampFormat

         Timestamps will be formatted as signed integers that
         represent the number of milliseconds since the UNIX
         epoch. Timestamps before the UNIX epoch are represented
         as negative values.

      .. zeek:enum:: JSON::TS_MILLIS_UNSIGNED JSON::TimestampFormat

         Timestamps will be formatted as unsigned integers that
         represent the number of milliseconds since the UNIX
         epoch. Timestamps before the UNIX epoch result in negative
         values being interpreted as large unsigned integers.

      .. zeek:enum:: JSON::TS_ISO8601 JSON::TimestampFormat

         Timestamps will be formatted in the ISO8601 DateTime format.
         Subseconds are also included which isn't actually part of the
         standard but most consumers that parse ISO8601 seem to be able
         to cope with that.


.. zeek:type:: KRB::AP_Options
   :source-code: base/init-bare.zeek 5697 5702

   :Type: :zeek:type:`record`


   .. zeek:field:: use_session_key :zeek:type:`bool`

      Indicates that user-to-user-authentication is in use


   .. zeek:field:: mutual_required :zeek:type:`bool`

      Mutual authentication is required


   AP Options. See :rfc:`4120`

.. zeek:type:: KRB::Encrypted_Data
   :source-code: base/init-bare.zeek 5715 5722

   :Type: :zeek:type:`record`


   .. zeek:field:: kvno :zeek:type:`count` :zeek:attr:`&optional`

      The key version number


   .. zeek:field:: cipher :zeek:type:`count`

      The cipher the data was encrypted with


   .. zeek:field:: ciphertext :zeek:type:`string`

      The encrypted data



.. zeek:type:: KRB::Error_Msg
   :source-code: base/init-bare.zeek 5756 5779

   :Type: :zeek:type:`record`


   .. zeek:field:: pvno :zeek:type:`count` :zeek:attr:`&optional`

      Protocol version number (5 for KRB5)


   .. zeek:field:: msg_type :zeek:type:`count` :zeek:attr:`&optional`

      The message type (30 for ERROR_MSG)


   .. zeek:field:: client_time :zeek:type:`time` :zeek:attr:`&optional`

      Current time on the client


   .. zeek:field:: server_time :zeek:type:`time` :zeek:attr:`&optional`

      Current time on the server


   .. zeek:field:: error_code :zeek:type:`count`

      The specific error code


   .. zeek:field:: client_realm :zeek:type:`string` :zeek:attr:`&optional`

      Realm of the ticket


   .. zeek:field:: client_name :zeek:type:`string` :zeek:attr:`&optional`

      Name on the ticket


   .. zeek:field:: service_realm :zeek:type:`string` :zeek:attr:`&optional`

      Realm of the service


   .. zeek:field:: service_name :zeek:type:`string` :zeek:attr:`&optional`

      Name of the service


   .. zeek:field:: error_text :zeek:type:`string` :zeek:attr:`&optional`

      Additional text to explain the error


   .. zeek:field:: pa_data :zeek:type:`vector` of :zeek:type:`KRB::Type_Value` :zeek:attr:`&optional`

      Optional pre-authentication data


   The data from the ERROR_MSG message. See :rfc:`4120`.

.. zeek:type:: KRB::Host_Address
   :source-code: base/init-bare.zeek 5725 5732

   :Type: :zeek:type:`record`


   .. zeek:field:: ip :zeek:type:`addr` :zeek:attr:`&log` :zeek:attr:`&optional`

      IPv4 or IPv6 address


   .. zeek:field:: netbios :zeek:type:`string` :zeek:attr:`&log` :zeek:attr:`&optional`

      NetBIOS address


   .. zeek:field:: unknown :zeek:type:`KRB::Type_Value` :zeek:attr:`&optional`

      Some other type that we don't support yet


   A Kerberos host address See :rfc:`4120`.

.. zeek:type:: KRB::Host_Address_Vector
   :source-code: base/init-bare.zeek 5734 5734

   :Type: :zeek:type:`vector` of :zeek:type:`KRB::Host_Address`


.. zeek:type:: KRB::KDC_Options
   :source-code: base/init-bare.zeek 5663 5694

   :Type: :zeek:type:`record`


   .. zeek:field:: forwardable :zeek:type:`bool`

      The ticket to be issued should have its forwardable flag set.


   .. zeek:field:: forwarded :zeek:type:`bool`

      A (TGT) request for forwarding.


   .. zeek:field:: proxiable :zeek:type:`bool`

      The ticket to be issued should have its proxiable flag set.


   .. zeek:field:: proxy :zeek:type:`bool`

      A request for a proxy.


   .. zeek:field:: allow_postdate :zeek:type:`bool`

      The ticket to be issued should have its may-postdate flag set.


   .. zeek:field:: postdated :zeek:type:`bool`

      A request for a postdated ticket.


   .. zeek:field:: renewable :zeek:type:`bool`

      The ticket to be issued should have its renewable  flag set.


   .. zeek:field:: opt_hardware_auth :zeek:type:`bool`

      Reserved for opt_hardware_auth


   .. zeek:field:: disable_transited_check :zeek:type:`bool`

      Request that the KDC not check the transited field of a TGT against
      the policy of the local realm before it will issue derivative tickets
      based on the TGT.


   .. zeek:field:: renewable_ok :zeek:type:`bool`

      If a ticket with the requested lifetime cannot be issued, a renewable
      ticket is acceptable


   .. zeek:field:: enc_tkt_in_skey :zeek:type:`bool`

      The ticket for the end server is to be encrypted in the session key
      from the additional TGT provided


   .. zeek:field:: renew :zeek:type:`bool`

      The request is for a renewal


   .. zeek:field:: validate :zeek:type:`bool`

      The request is to validate a postdated ticket.


   KDC Options. See :rfc:`4120`

.. zeek:type:: KRB::KDC_Request
   :source-code: base/init-bare.zeek 5800 5831

   :Type: :zeek:type:`record`


   .. zeek:field:: pvno :zeek:type:`count`

      Protocol version number (5 for KRB5)


   .. zeek:field:: msg_type :zeek:type:`count`

      The message type (10 for AS_REQ, 12 for TGS_REQ)


   .. zeek:field:: pa_data :zeek:type:`vector` of :zeek:type:`KRB::Type_Value` :zeek:attr:`&optional`

      Optional pre-authentication data


   .. zeek:field:: kdc_options :zeek:type:`KRB::KDC_Options` :zeek:attr:`&optional`

      Options specified in the request


   .. zeek:field:: client_name :zeek:type:`string` :zeek:attr:`&optional`

      Name on the ticket


   .. zeek:field:: service_realm :zeek:type:`string` :zeek:attr:`&optional`

      Realm of the service


   .. zeek:field:: service_name :zeek:type:`string` :zeek:attr:`&optional`

      Name of the service


   .. zeek:field:: from :zeek:type:`time` :zeek:attr:`&optional`

      Time the ticket is good from


   .. zeek:field:: till :zeek:type:`time` :zeek:attr:`&optional`

      Time the ticket is good till


   .. zeek:field:: rtime :zeek:type:`time` :zeek:attr:`&optional`

      The requested renew-till time


   .. zeek:field:: nonce :zeek:type:`count` :zeek:attr:`&optional`

      A random nonce generated by the client


   .. zeek:field:: encryption_types :zeek:type:`vector` of :zeek:type:`count` :zeek:attr:`&optional`

      The desired encryption algorithms, in order of preference


   .. zeek:field:: host_addrs :zeek:type:`vector` of :zeek:type:`KRB::Host_Address` :zeek:attr:`&optional`

      Any additional addresses the ticket should be valid for


   .. zeek:field:: additional_tickets :zeek:type:`vector` of :zeek:type:`KRB::Ticket` :zeek:attr:`&optional`

      Additional tickets may be included for certain transactions


   The data from the AS_REQ and TGS_REQ messages. See :rfc:`4120`.

.. zeek:type:: KRB::KDC_Response
   :source-code: base/init-bare.zeek 5834 5850

   :Type: :zeek:type:`record`


   .. zeek:field:: pvno :zeek:type:`count`

      Protocol version number (5 for KRB5)


   .. zeek:field:: msg_type :zeek:type:`count`

      The message type (11 for AS_REP, 13 for TGS_REP)


   .. zeek:field:: pa_data :zeek:type:`vector` of :zeek:type:`KRB::Type_Value` :zeek:attr:`&optional`

      Optional pre-authentication data


   .. zeek:field:: client_realm :zeek:type:`string` :zeek:attr:`&optional`

      Realm on the ticket


   .. zeek:field:: client_name :zeek:type:`string`

      Name on the service


   .. zeek:field:: ticket :zeek:type:`KRB::Ticket`

      The ticket that was issued


   .. zeek:field:: enc_part :zeek:type:`KRB::Encrypted_Data`

      The encrypted session key for the client


   The data from the AS_REQ and TGS_REQ messages. See :rfc:`4120`.

.. zeek:type:: KRB::SAFE_Msg
   :source-code: base/init-bare.zeek 5737 5753

   :Type: :zeek:type:`record`


   .. zeek:field:: pvno :zeek:type:`count`

      Protocol version number (5 for KRB5)


   .. zeek:field:: msg_type :zeek:type:`count`

      The message type (20 for SAFE_MSG)


   .. zeek:field:: data :zeek:type:`string`

      The application-specific data that is being passed
      from the sender to the receiver


   .. zeek:field:: timestamp :zeek:type:`time` :zeek:attr:`&optional`

      Current time from the sender of the message


   .. zeek:field:: seq :zeek:type:`count` :zeek:attr:`&optional`

      Sequence number used to detect replays


   .. zeek:field:: sender :zeek:type:`KRB::Host_Address` :zeek:attr:`&optional`

      Sender address


   .. zeek:field:: recipient :zeek:type:`KRB::Host_Address` :zeek:attr:`&optional`

      Recipient address


   The data from the SAFE message. See :rfc:`4120`.

.. zeek:type:: KRB::Ticket
   :source-code: base/init-bare.zeek 5782 5795

   :Type: :zeek:type:`record`


   .. zeek:field:: pvno :zeek:type:`count`

      Protocol version number (5 for KRB5)


   .. zeek:field:: realm :zeek:type:`string`

      Realm


   .. zeek:field:: service_name :zeek:type:`string`

      Name of the service


   .. zeek:field:: cipher :zeek:type:`count`

      Cipher the ticket was encrypted with


   .. zeek:field:: ciphertext :zeek:type:`string` :zeek:attr:`&optional`

      Cipher text of the ticket


   .. zeek:field:: authenticationinfo :zeek:type:`string` :zeek:attr:`&optional`

      Authentication info


   A Kerberos ticket. See :rfc:`4120`.

.. zeek:type:: KRB::Ticket_Vector
   :source-code: base/init-bare.zeek 5797 5797

   :Type: :zeek:type:`vector` of :zeek:type:`KRB::Ticket`


.. zeek:type:: KRB::Type_Value
   :source-code: base/init-bare.zeek 5706 5711

   :Type: :zeek:type:`record`


   .. zeek:field:: data_type :zeek:type:`count`

      The data type


   .. zeek:field:: val :zeek:type:`string`

      The data value


   Used in a few places in the Kerberos analyzer for elements
   that have a type and a string value.

.. zeek:type:: KRB::Type_Value_Vector
   :source-code: base/init-bare.zeek 5713 5713

   :Type: :zeek:type:`vector` of :zeek:type:`KRB::Type_Value`


.. zeek:type:: MOUNT3::dirmntargs_t
   :source-code: base/init-bare.zeek 3873 3875

   :Type: :zeek:type:`record`


   .. zeek:field:: dirname :zeek:type:`string`

      Name of directory to mount


   MOUNT *mnt* arguments.

   .. zeek:see:: mount_proc_mnt

.. zeek:type:: MOUNT3::info_t
   :source-code: base/init-bare.zeek 3841 3868

   :Type: :zeek:type:`record`


   .. zeek:field:: rpc_stat :zeek:type:`rpc_status`

      The RPC status.


   .. zeek:field:: mnt_stat :zeek:type:`MOUNT3::status_t`

      The MOUNT status.


   .. zeek:field:: req_start :zeek:type:`time`

      The start time of the request.


   .. zeek:field:: req_dur :zeek:type:`interval`

      The duration of the request.


   .. zeek:field:: req_len :zeek:type:`count`

      The length in bytes of the request.


   .. zeek:field:: rep_start :zeek:type:`time`

      The start time of the reply.


   .. zeek:field:: rep_dur :zeek:type:`interval`

      The duration of the reply.


   .. zeek:field:: rep_len :zeek:type:`count`

      The length in bytes of the reply.


   .. zeek:field:: rpc_uid :zeek:type:`count`

      The user id of the reply.


   .. zeek:field:: rpc_gid :zeek:type:`count`

      The group id of the reply.


   .. zeek:field:: rpc_stamp :zeek:type:`count`

      The stamp of the reply.


   .. zeek:field:: rpc_machine_name :zeek:type:`string`

      The machine name of the reply.


   .. zeek:field:: rpc_auxgids :zeek:type:`index_vec`

      The auxiliary ids of the reply.


   Record summarizing the general results and status of MOUNT3
   request/reply pairs.

   Note that when *rpc_stat* or *mount_stat* indicates not successful,
   the reply record passed to the corresponding event will be empty and
   contain uninitialized fields, so don't use it. Also note that time

.. zeek:type:: MOUNT3::mnt_reply_t
   :source-code: base/init-bare.zeek 3881 3884

   :Type: :zeek:type:`record`


   .. zeek:field:: dirfh :zeek:type:`string` :zeek:attr:`&optional`

      Dir handle


   .. zeek:field:: auth_flavors :zeek:type:`vector` of :zeek:type:`MOUNT3::auth_flavor_t` :zeek:attr:`&optional`

      Returned authentication flavors


   MOUNT lookup reply. If the mount failed, *dir_attr* may be set. If the
   mount succeeded, *fh* is always set.

   .. zeek:see:: mount_proc_mnt

.. zeek:type:: MQTT::ConnectAckMsg
   :source-code: base/init-bare.zeek 6244 6253

   :Type: :zeek:type:`record`


   .. zeek:field:: return_code :zeek:type:`count`

      Return code from the connack message


   .. zeek:field:: session_present :zeek:type:`bool`

      The Session present flag helps the client
      establish whether the Client and Server
      have a consistent view about whether there
      is already stored Session state.



.. zeek:type:: MQTT::ConnectMsg
   :source-code: base/init-bare.zeek 6212 6242

   :Type: :zeek:type:`record`


   .. zeek:field:: protocol_name :zeek:type:`string`

      Protocol name


   .. zeek:field:: protocol_version :zeek:type:`count`

      Protocol version


   .. zeek:field:: client_id :zeek:type:`string`

      Identifies the Client to the Server.


   .. zeek:field:: keep_alive :zeek:type:`interval`

      The maximum time interval that is permitted to elapse between the
      point at which the Client finishes transmitting one Control Packet
      and the point it starts sending the next.


   .. zeek:field:: clean_session :zeek:type:`bool`

      The clean_session flag indicates if the server should or shouldn't
      use a clean session or use existing previous session state.


   .. zeek:field:: will_retain :zeek:type:`bool`

      Specifies if the Will Message is to be retained when it is published.


   .. zeek:field:: will_qos :zeek:type:`count`

      Specifies the QoS level to be used when publishing the Will Message.


   .. zeek:field:: will_topic :zeek:type:`string` :zeek:attr:`&optional`

      Topic to publish the Will message to.


   .. zeek:field:: will_msg :zeek:type:`string` :zeek:attr:`&optional`

      The actual Will message to publish.


   .. zeek:field:: username :zeek:type:`string` :zeek:attr:`&optional`

      Username to use for authentication to the server.


   .. zeek:field:: password :zeek:type:`string` :zeek:attr:`&optional`

      Pass to use for authentication to the server.



.. zeek:type:: MQTT::PublishMsg
   :source-code: base/init-bare.zeek 6255 6277

   :Type: :zeek:type:`record`


   .. zeek:field:: dup :zeek:type:`bool`

      Indicates if this is the first attempt at publishing the message.


   .. zeek:field:: qos :zeek:type:`count`

      Indicates what level of QoS is enabled for this message.


   .. zeek:field:: retain :zeek:type:`bool`

      Indicates if the server should retain this message so that clients
      subscribing to the topic in the future will receive this message
      automatically.


   .. zeek:field:: topic :zeek:type:`string`

      Name of the topic the published message is directed into.


   .. zeek:field:: payload :zeek:type:`string`

      Payload of the published message.


   .. zeek:field:: payload_len :zeek:type:`count`

      The actual length of the payload in the case the *payload*
      field's contents were truncated according to
      :zeek:see:`MQTT::max_payload_size`.



.. zeek:type:: MatcherStats
   :source-code: base/init-bare.zeek 1252 1260

   :Type: :zeek:type:`record`


   .. zeek:field:: matchers :zeek:type:`count`

      Number of distinct RE matchers.


   .. zeek:field:: nfa_states :zeek:type:`count`

      Number of NFA states across all matchers.


   .. zeek:field:: dfa_states :zeek:type:`count`

      Number of DFA states across all matchers.


   .. zeek:field:: computed :zeek:type:`count`

      Number of computed DFA state transitions.


   .. zeek:field:: mem :zeek:type:`count`

      Number of bytes used by DFA states.


   .. zeek:field:: hits :zeek:type:`count`

      Number of cache hits.


   .. zeek:field:: misses :zeek:type:`count`

      Number of cache misses.


   Statistics of all regular expression matchers.

   .. zeek:see:: get_matcher_stats

.. zeek:type:: ModbusCoils
   :source-code: base/init-bare.zeek 3427 3427

   :Type: :zeek:type:`vector` of :zeek:type:`bool`

   A vector of boolean values that indicate the setting
   for a range of modbus coils.

.. zeek:type:: ModbusFileRecordRequest
   :source-code: base/init-bare.zeek 3447 3452

   :Type: :zeek:type:`record`


   .. zeek:field:: ref_type :zeek:type:`count`


   .. zeek:field:: file_num :zeek:type:`count`


   .. zeek:field:: record_num :zeek:type:`count`


   .. zeek:field:: record_len :zeek:type:`count`



.. zeek:type:: ModbusFileRecordRequests
   :source-code: base/init-bare.zeek 3454 3454

   :Type: :zeek:type:`vector` of :zeek:type:`ModbusFileRecordRequest`


.. zeek:type:: ModbusFileRecordResponse
   :source-code: base/init-bare.zeek 3456 3460

   :Type: :zeek:type:`record`


   .. zeek:field:: file_len :zeek:type:`count`


   .. zeek:field:: ref_type :zeek:type:`count`


   .. zeek:field:: record_data :zeek:type:`string`



.. zeek:type:: ModbusFileRecordResponses
   :source-code: base/init-bare.zeek 3462 3462

   :Type: :zeek:type:`vector` of :zeek:type:`ModbusFileRecordResponse`


.. zeek:type:: ModbusFileReference
   :source-code: base/init-bare.zeek 3464 3470

   :Type: :zeek:type:`record`


   .. zeek:field:: ref_type :zeek:type:`count`


   .. zeek:field:: file_num :zeek:type:`count`


   .. zeek:field:: record_num :zeek:type:`count`


   .. zeek:field:: record_len :zeek:type:`count`


   .. zeek:field:: record_data :zeek:type:`string`



.. zeek:type:: ModbusFileReferences
   :source-code: base/init-bare.zeek 3472 3472

   :Type: :zeek:type:`vector` of :zeek:type:`ModbusFileReference`


.. zeek:type:: ModbusHeaders
   :source-code: base/init-bare.zeek 3433 3445

   :Type: :zeek:type:`record`


   .. zeek:field:: tid :zeek:type:`count`

      Transaction identifier


   .. zeek:field:: pid :zeek:type:`count`

      Protocol identifier


   .. zeek:field:: uid :zeek:type:`count`

      Unit identifier (previously 'slave address')


   .. zeek:field:: function_code :zeek:type:`count`

      MODBUS function code


   .. zeek:field:: len :zeek:type:`count`

      Length of the application PDU following the header plus
      one byte for the uid field.



.. zeek:type:: ModbusRegisters
   :source-code: base/init-bare.zeek 3431 3431

   :Type: :zeek:type:`vector` of :zeek:type:`count`

   A vector of count values that represent 16bit modbus
   register values.

.. zeek:type:: NFS3::delobj_reply_t
   :source-code: base/init-bare.zeek 3744 3747

   :Type: :zeek:type:`record`


   .. zeek:field:: dir_pre_attr :zeek:type:`NFS3::wcc_attr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   .. zeek:field:: dir_post_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   NFS reply for *remove*, *rmdir*. Corresponds to *wcc_data* in the spec.

   .. zeek:see:: nfs_proc_remove nfs_proc_rmdir

.. zeek:type:: NFS3::direntry_t
   :source-code: base/init-bare.zeek 3775 3781

   :Type: :zeek:type:`record`


   .. zeek:field:: fileid :zeek:type:`count`

      E.g., inode number.


   .. zeek:field:: fname :zeek:type:`string`

      Filename.


   .. zeek:field:: cookie :zeek:type:`count`

      Cookie value.


   .. zeek:field:: attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      *readdirplus*: the *fh* attributes for the entry.


   .. zeek:field:: fh :zeek:type:`string` :zeek:attr:`&optional`

      *readdirplus*: the *fh* for the entry


   NFS *direntry*.  *fh* and *attr* are used for *readdirplus*. However,
   even for *readdirplus* they may not be filled out.

   .. zeek:see:: NFS3::direntry_vec_t NFS3::readdir_reply_t

.. zeek:type:: NFS3::direntry_vec_t
   :source-code: base/init-bare.zeek 3786 3786

   :Type: :zeek:type:`vector` of :zeek:type:`NFS3::direntry_t`

   Vector of NFS *direntry*.

   .. zeek:see:: NFS3::readdir_reply_t

.. zeek:type:: NFS3::diropargs_t
   :source-code: base/init-bare.zeek 3601 3604

   :Type: :zeek:type:`record`


   .. zeek:field:: dirfh :zeek:type:`string`

      The file handle of the directory.


   .. zeek:field:: fname :zeek:type:`string`

      The name of the file we are interested in.


   NFS *readdir* arguments.

   .. zeek:see:: nfs_proc_readdir

.. zeek:type:: NFS3::fattr_t
   :source-code: base/init-bare.zeek 3573 3588

   :Type: :zeek:type:`record`


   .. zeek:field:: ftype :zeek:type:`NFS3::file_type_t`

      File type.


   .. zeek:field:: mode :zeek:type:`count`

      Mode


   .. zeek:field:: nlink :zeek:type:`count`

      Number of links.


   .. zeek:field:: uid :zeek:type:`count`

      User ID.


   .. zeek:field:: gid :zeek:type:`count`

      Group ID.


   .. zeek:field:: size :zeek:type:`count`

      Size.


   .. zeek:field:: used :zeek:type:`count`

      TODO.


   .. zeek:field:: rdev1 :zeek:type:`count`

      TODO.


   .. zeek:field:: rdev2 :zeek:type:`count`

      TODO.


   .. zeek:field:: fsid :zeek:type:`count`

      TODO.


   .. zeek:field:: fileid :zeek:type:`count`

      TODO.


   .. zeek:field:: atime :zeek:type:`time`

      Time of last access.


   .. zeek:field:: mtime :zeek:type:`time`

      Time of last modification.


   .. zeek:field:: ctime :zeek:type:`time`

      Time of creation.


   NFS file attributes. Field names are based on RFC 1813.

   .. zeek:see:: nfs_proc_getattr

.. zeek:type:: NFS3::fsstat_t
   :source-code: base/init-bare.zeek 3800 3809

   :Type: :zeek:type:`record`


   .. zeek:field:: attrs :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Attributes.


   .. zeek:field:: tbytes :zeek:type:`double`

      TODO.


   .. zeek:field:: fbytes :zeek:type:`double`

      TODO.


   .. zeek:field:: abytes :zeek:type:`double`

      TODO.


   .. zeek:field:: tfiles :zeek:type:`double`

      TODO.


   .. zeek:field:: ffiles :zeek:type:`double`

      TODO.


   .. zeek:field:: afiles :zeek:type:`double`

      TODO.


   .. zeek:field:: invarsec :zeek:type:`interval`

      TODO.


   NFS *fsstat*.

.. zeek:type:: NFS3::info_t
   :source-code: base/init-bare.zeek 3529 3556

   :Type: :zeek:type:`record`


   .. zeek:field:: rpc_stat :zeek:type:`rpc_status`

      The RPC status.


   .. zeek:field:: nfs_stat :zeek:type:`NFS3::status_t`

      The NFS status.


   .. zeek:field:: req_start :zeek:type:`time`

      The start time of the request.


   .. zeek:field:: req_dur :zeek:type:`interval`

      The duration of the request.


   .. zeek:field:: req_len :zeek:type:`count`

      The length in bytes of the request.


   .. zeek:field:: rep_start :zeek:type:`time`

      The start time of the reply.


   .. zeek:field:: rep_dur :zeek:type:`interval`

      The duration of the reply.


   .. zeek:field:: rep_len :zeek:type:`count`

      The length in bytes of the reply.


   .. zeek:field:: rpc_uid :zeek:type:`count`

      The user id of the reply.


   .. zeek:field:: rpc_gid :zeek:type:`count`

      The group id of the reply.


   .. zeek:field:: rpc_stamp :zeek:type:`count`

      The stamp of the reply.


   .. zeek:field:: rpc_machine_name :zeek:type:`string`

      The machine name of the reply.


   .. zeek:field:: rpc_auxgids :zeek:type:`index_vec`

      The auxiliary ids of the reply.


   Record summarizing the general results and status of NFSv3
   request/reply pairs.

   Note that when *rpc_stat* or *nfs_stat* indicates not successful,
   the reply record passed to the corresponding event will be empty and
   contain uninitialized fields, so don't use it. Also note that time
   and duration values might not be fully accurate. For TCP, we record
   times when the corresponding chunk of data is delivered to the
   analyzer. Depending on the reassembler, this might be well after the
   first packet of the request was received.

   .. zeek:see:: nfs_proc_create nfs_proc_getattr nfs_proc_lookup
      nfs_proc_mkdir nfs_proc_not_implemented nfs_proc_null
      nfs_proc_read nfs_proc_readdir nfs_proc_readlink nfs_proc_remove
      nfs_proc_rmdir nfs_proc_write nfs_reply_status

.. zeek:type:: NFS3::link_reply_t
   :source-code: base/init-bare.zeek 3701 3705

   :Type: :zeek:type:`record`


   .. zeek:field:: post_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional post-operation attributes of the file system object identified by file


   .. zeek:field:: preattr :zeek:type:`NFS3::wcc_attr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ file.


   .. zeek:field:: postattr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ file.


   NFS *link* reply.

   .. zeek:see:: nfs_proc_link

.. zeek:type:: NFS3::linkargs_t
   :source-code: base/init-bare.zeek 3627 3630

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string`

      The file handle for the existing file system object.


   .. zeek:field:: link :zeek:type:`NFS3::diropargs_t`

      The location of the link to be created.


   NFS *link* arguments.

   .. zeek:see:: nfs_proc_link

.. zeek:type:: NFS3::lookup_reply_t
   :source-code: base/init-bare.zeek 3645 3649

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string` :zeek:attr:`&optional`

      File handle of object looked up.


   .. zeek:field:: obj_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ file


   .. zeek:field:: dir_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   NFS lookup reply. If the lookup failed, *dir_attr* may be set. If the
   lookup succeeded, *fh* is always set and *obj_attr* and *dir_attr*
   may be set.

   .. zeek:see:: nfs_proc_lookup

.. zeek:type:: NFS3::newobj_reply_t
   :source-code: base/init-bare.zeek 3734 3739

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string` :zeek:attr:`&optional`

      File handle of object created.


   .. zeek:field:: obj_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ new object.


   .. zeek:field:: dir_pre_attr :zeek:type:`NFS3::wcc_attr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   .. zeek:field:: dir_post_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   NFS reply for *create*, *mkdir*, and *symlink*. If the proc
   failed, *dir_\*_attr* may be set. If the proc succeeded, *fh* and the
   *attr*'s may be set. Note: no guarantee that *fh* is set after
   success.

   .. zeek:see:: nfs_proc_create nfs_proc_mkdir

.. zeek:type:: NFS3::read_reply_t
   :source-code: base/init-bare.zeek 3662 3667

   :Type: :zeek:type:`record`


   .. zeek:field:: attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Attributes.


   .. zeek:field:: size :zeek:type:`count` :zeek:attr:`&optional`

      Number of bytes read.


   .. zeek:field:: eof :zeek:type:`bool` :zeek:attr:`&optional`

      Sid the read end at EOF.


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      The actual data; not yet implemented.


   NFS *read* reply. If the lookup fails, *attr* may be set. If the
   lookup succeeds, *attr* may be set and all other fields are set.

.. zeek:type:: NFS3::readargs_t
   :source-code: base/init-bare.zeek 3654 3658

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string`

      File handle to read from.


   .. zeek:field:: offset :zeek:type:`count`

      Offset in file.


   .. zeek:field:: size :zeek:type:`count`

      Number of bytes to read.


   NFS *read* arguments.

   .. zeek:see:: nfs_proc_read

.. zeek:type:: NFS3::readdir_reply_t
   :source-code: base/init-bare.zeek 3791 3797

   :Type: :zeek:type:`record`


   .. zeek:field:: isplus :zeek:type:`bool`

      True if the reply for a *readdirplus* request.


   .. zeek:field:: dir_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Directory attributes.


   .. zeek:field:: cookieverf :zeek:type:`count` :zeek:attr:`&optional`

      TODO.


   .. zeek:field:: entries :zeek:type:`NFS3::direntry_vec_t` :zeek:attr:`&optional`

      Returned directory entries.


   .. zeek:field:: eof :zeek:type:`bool`

      If true, no more entries in directory.


   NFS *readdir* reply. Used for *readdir* and *readdirplus*. If an is
   returned, *dir_attr* might be set. On success, *dir_attr* may be set,
   all others must be set.

.. zeek:type:: NFS3::readdirargs_t
   :source-code: base/init-bare.zeek 3762 3769

   :Type: :zeek:type:`record`


   .. zeek:field:: isplus :zeek:type:`bool`

      Is this a readdirplus request?


   .. zeek:field:: dirfh :zeek:type:`string`

      The directory filehandle.


   .. zeek:field:: cookie :zeek:type:`count`

      Cookie / pos in dir; 0 for first call.


   .. zeek:field:: cookieverf :zeek:type:`count`

      The cookie verifier.


   .. zeek:field:: dircount :zeek:type:`count`

      "count" field for readdir; maxcount otherwise (in bytes).


   .. zeek:field:: maxcount :zeek:type:`count` :zeek:attr:`&optional`

      Only used for readdirplus. in bytes.


   NFS *readdir* arguments. Used for both *readdir* and *readdirplus*.

   .. zeek:see:: nfs_proc_readdir

.. zeek:type:: NFS3::readlink_reply_t
   :source-code: base/init-bare.zeek 3673 3676

   :Type: :zeek:type:`record`


   .. zeek:field:: attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Attributes.


   .. zeek:field:: nfspath :zeek:type:`string` :zeek:attr:`&optional`

      Contents of the symlink; in general a pathname as text.


   NFS *readline* reply. If the request fails, *attr* may be set. If the
   request succeeds, *attr* may be set and all other fields are set.

   .. zeek:see:: nfs_proc_readlink

.. zeek:type:: NFS3::renameobj_reply_t
   :source-code: base/init-bare.zeek 3752 3757

   :Type: :zeek:type:`record`


   .. zeek:field:: src_dir_pre_attr :zeek:type:`NFS3::wcc_attr_t`


   .. zeek:field:: src_dir_post_attr :zeek:type:`NFS3::fattr_t`


   .. zeek:field:: dst_dir_pre_attr :zeek:type:`NFS3::wcc_attr_t`


   .. zeek:field:: dst_dir_post_attr :zeek:type:`NFS3::fattr_t`


   NFS reply for *rename*. Corresponds to *wcc_data* in the spec.

   .. zeek:see:: nfs_proc_rename

.. zeek:type:: NFS3::renameopargs_t
   :source-code: base/init-bare.zeek 3609 3614

   :Type: :zeek:type:`record`


   .. zeek:field:: src_dirfh :zeek:type:`string`


   .. zeek:field:: src_fname :zeek:type:`string`


   .. zeek:field:: dst_dirfh :zeek:type:`string`


   .. zeek:field:: dst_fname :zeek:type:`string`


   NFS *rename* arguments.

   .. zeek:see:: nfs_proc_rename

.. zeek:type:: NFS3::sattr_reply_t
   :source-code: base/init-bare.zeek 3710 3713

   :Type: :zeek:type:`record`


   .. zeek:field:: dir_pre_attr :zeek:type:`NFS3::wcc_attr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   .. zeek:field:: dir_post_attr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Optional attributes associated w/ dir.


   NFS *sattr* reply. If the request fails, *pre|post* attr may be set.
   If the request succeeds, *pre|post* attr are set.


.. zeek:type:: NFS3::sattr_t
   :source-code: base/init-bare.zeek 3561 3568

   :Type: :zeek:type:`record`


   .. zeek:field:: mode :zeek:type:`count` :zeek:attr:`&optional`

      Mode


   .. zeek:field:: uid :zeek:type:`count` :zeek:attr:`&optional`

      User ID.


   .. zeek:field:: gid :zeek:type:`count` :zeek:attr:`&optional`

      Group ID.


   .. zeek:field:: size :zeek:type:`count` :zeek:attr:`&optional`

      Size.


   .. zeek:field:: atime :zeek:type:`NFS3::time_how_t` :zeek:attr:`&optional`

      Time of last access.


   .. zeek:field:: mtime :zeek:type:`NFS3::time_how_t` :zeek:attr:`&optional`

      Time of last modification.


   NFS file attributes. Field names are based on RFC 1813.

   .. zeek:see:: nfs_proc_sattr

.. zeek:type:: NFS3::sattrargs_t
   :source-code: base/init-bare.zeek 3635 3638

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string`

      The file handle for the existing file system object.


   .. zeek:field:: new_attributes :zeek:type:`NFS3::sattr_t`

      The new attributes for the file.


   NFS *sattr* arguments.

   .. zeek:see:: nfs_proc_sattr

.. zeek:type:: NFS3::symlinkargs_t
   :source-code: base/init-bare.zeek 3619 3622

   :Type: :zeek:type:`record`


   .. zeek:field:: link :zeek:type:`NFS3::diropargs_t`

      The location of the link to be created.


   .. zeek:field:: symlinkdata :zeek:type:`NFS3::symlinkdata_t`

      The symbolic link to be created.


   NFS *symlink* arguments.

   .. zeek:see:: nfs_proc_symlink

.. zeek:type:: NFS3::symlinkdata_t
   :source-code: base/init-bare.zeek 3593 3596

   :Type: :zeek:type:`record`


   .. zeek:field:: symlink_attributes :zeek:type:`NFS3::sattr_t`

      The initial attributes for the symbolic link


   .. zeek:field:: nfspath :zeek:type:`string` :zeek:attr:`&optional`

      The string containing the symbolic link data.


   NFS symlinkdata attributes. Field names are based on RFC 1813

   .. zeek:see:: nfs_proc_symlink

.. zeek:type:: NFS3::wcc_attr_t
   :source-code: base/init-bare.zeek 3692 3696

   :Type: :zeek:type:`record`


   .. zeek:field:: size :zeek:type:`count`

      The size.


   .. zeek:field:: atime :zeek:type:`time`

      Access time.


   .. zeek:field:: mtime :zeek:type:`time`

      Modification time.


   NFS *wcc* attributes.

   .. zeek:see:: NFS3::write_reply_t

.. zeek:type:: NFS3::write_reply_t
   :source-code: base/init-bare.zeek 3720 3726

   :Type: :zeek:type:`record`


   .. zeek:field:: preattr :zeek:type:`NFS3::wcc_attr_t` :zeek:attr:`&optional`

      Pre operation attributes.


   .. zeek:field:: postattr :zeek:type:`NFS3::fattr_t` :zeek:attr:`&optional`

      Post operation attributes.


   .. zeek:field:: size :zeek:type:`count` :zeek:attr:`&optional`

      Size.


   .. zeek:field:: commited :zeek:type:`NFS3::stable_how_t` :zeek:attr:`&optional`

      TODO.


   .. zeek:field:: verf :zeek:type:`count` :zeek:attr:`&optional`

      Write verifier cookie.


   NFS *write* reply. If the request fails, *pre|post* attr may be set.
   If the request succeeds, *pre|post* attr may be set and all other
   fields are set.

   .. zeek:see:: nfs_proc_write

.. zeek:type:: NFS3::writeargs_t
   :source-code: base/init-bare.zeek 3681 3687

   :Type: :zeek:type:`record`


   .. zeek:field:: fh :zeek:type:`string`

      File handle to write to.


   .. zeek:field:: offset :zeek:type:`count`

      Offset in file.


   .. zeek:field:: size :zeek:type:`count`

      Number of bytes to write.


   .. zeek:field:: stable :zeek:type:`NFS3::stable_how_t`

      How and when data is committed.


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      The actual data; not implemented yet.


   NFS *write* arguments.

   .. zeek:see:: nfs_proc_write

.. zeek:type:: NTLM::AVs
   :source-code: base/init-bare.zeek 4162 4186

   :Type: :zeek:type:`record`


   .. zeek:field:: nb_computer_name :zeek:type:`string`

      The server's NetBIOS computer name


   .. zeek:field:: nb_domain_name :zeek:type:`string`

      The server's NetBIOS domain name


   .. zeek:field:: dns_computer_name :zeek:type:`string` :zeek:attr:`&optional`

      The FQDN of the computer


   .. zeek:field:: dns_domain_name :zeek:type:`string` :zeek:attr:`&optional`

      The FQDN of the domain


   .. zeek:field:: dns_tree_name :zeek:type:`string` :zeek:attr:`&optional`

      The FQDN of the forest


   .. zeek:field:: constrained_auth :zeek:type:`bool` :zeek:attr:`&optional`

      Indicates to the client that the account
      authentication is constrained


   .. zeek:field:: timestamp :zeek:type:`time` :zeek:attr:`&optional`

      The associated timestamp, if present


   .. zeek:field:: single_host_id :zeek:type:`count` :zeek:attr:`&optional`

      Indicates that the client is providing
      a machine ID created at computer startup to
      identify the calling machine


   .. zeek:field:: target_name :zeek:type:`string` :zeek:attr:`&optional`

      The SPN of the target server



.. zeek:type:: NTLM::Authenticate
   :source-code: base/init-bare.zeek 4204 4219

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`NTLM::NegotiateFlags`

      The negotiate flags


   .. zeek:field:: domain_name :zeek:type:`string` :zeek:attr:`&optional`

      The domain or computer name hosting the account


   .. zeek:field:: user_name :zeek:type:`string` :zeek:attr:`&optional`

      The name of the user to be authenticated.


   .. zeek:field:: workstation :zeek:type:`string` :zeek:attr:`&optional`

      The name of the computer to which the user was logged on.


   .. zeek:field:: session_key :zeek:type:`string` :zeek:attr:`&optional`

      The session key


   .. zeek:field:: version :zeek:type:`NTLM::Version` :zeek:attr:`&optional`

      The Windows version information, if supplied


   .. zeek:field:: response :zeek:type:`string` :zeek:attr:`&optional`

      The client's response for the challenge



.. zeek:type:: NTLM::Challenge
   :source-code: base/init-bare.zeek 4188 4202

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`NTLM::NegotiateFlags`

      The negotiate flags


   .. zeek:field:: challenge :zeek:type:`count`

      A 64-bit value that contains the NTLM challenge.


   .. zeek:field:: target_name :zeek:type:`string` :zeek:attr:`&optional`

      The server authentication realm. If the server is
      domain-joined, the name of the domain. Otherwise
      the server name. See flags.target_type_domain
      and flags.target_type_server


   .. zeek:field:: version :zeek:type:`NTLM::Version` :zeek:attr:`&optional`

      The Windows version information, if supplied


   .. zeek:field:: target_info :zeek:type:`NTLM::AVs` :zeek:attr:`&optional`

      Attribute-value pairs specified by the server



.. zeek:type:: NTLM::Negotiate
   :source-code: base/init-bare.zeek 4151 4160

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`NTLM::NegotiateFlags`

      The negotiate flags


   .. zeek:field:: domain_name :zeek:type:`string` :zeek:attr:`&optional`

      The domain name of the client, if known


   .. zeek:field:: workstation :zeek:type:`string` :zeek:attr:`&optional`

      The machine name of the client, if known


   .. zeek:field:: version :zeek:type:`NTLM::Version` :zeek:attr:`&optional`

      The Windows version information, if supplied



.. zeek:type:: NTLM::NegotiateFlags
   :source-code: base/init-bare.zeek 4096 4149

   :Type: :zeek:type:`record`


   .. zeek:field:: negotiate_56 :zeek:type:`bool`

      If set, requires 56-bit encryption


   .. zeek:field:: negotiate_key_exch :zeek:type:`bool`

      If set, requests an explicit key exchange


   .. zeek:field:: negotiate_128 :zeek:type:`bool`

      If set, requests 128-bit session key negotiation


   .. zeek:field:: negotiate_version :zeek:type:`bool`

      If set, requests the protocol version number


   .. zeek:field:: negotiate_target_info :zeek:type:`bool`

      If set, indicates that the TargetInfo fields in the
      CHALLENGE_MESSAGE are populated


   .. zeek:field:: request_non_nt_session_key :zeek:type:`bool`

      If set, requests the usage of the LMOWF function


   .. zeek:field:: negotiate_identify :zeek:type:`bool`

      If set, requests and identify level token


   .. zeek:field:: negotiate_extended_sessionsecurity :zeek:type:`bool`

      If set, requests usage of NTLM v2 session security
      Note: NTLM v2 session security is actually NTLM v1


   .. zeek:field:: target_type_server :zeek:type:`bool`

      If set, TargetName must be a server name


   .. zeek:field:: target_type_domain :zeek:type:`bool`

      If set, TargetName must be a domain name


   .. zeek:field:: negotiate_always_sign :zeek:type:`bool`

      If set, requests the presence of a signature block
      on all messages


   .. zeek:field:: negotiate_oem_workstation_supplied :zeek:type:`bool`

      If set, the workstation name is provided


   .. zeek:field:: negotiate_oem_domain_supplied :zeek:type:`bool`

      If set, the domain name is provided


   .. zeek:field:: negotiate_anonymous_connection :zeek:type:`bool`

      If set, the connection should be anonymous


   .. zeek:field:: negotiate_ntlm :zeek:type:`bool`

      If set, requests usage of NTLM v1


   .. zeek:field:: negotiate_lm_key :zeek:type:`bool`

      If set, requests LAN Manager session key computation


   .. zeek:field:: negotiate_datagram :zeek:type:`bool`

      If set, requests connectionless authentication


   .. zeek:field:: negotiate_seal :zeek:type:`bool`

      If set, requests session key negotiation for message
      confidentiality


   .. zeek:field:: negotiate_sign :zeek:type:`bool`

      If set, requests session key negotiation for message
      signatures


   .. zeek:field:: request_target :zeek:type:`bool`

      If set, the TargetName field is present


   .. zeek:field:: negotiate_oem :zeek:type:`bool`

      If set, requests OEM character set encoding


   .. zeek:field:: negotiate_unicode :zeek:type:`bool`

      If set, requests Unicode character set encoding



.. zeek:type:: NTLM::Version
   :source-code: base/init-bare.zeek 4085 4094

   :Type: :zeek:type:`record`


   .. zeek:field:: major :zeek:type:`count`

      The major version of the Windows operating system in use


   .. zeek:field:: minor :zeek:type:`count`

      The minor version of the Windows operating system in use


   .. zeek:field:: build :zeek:type:`count`

      The build number of the Windows operating system in use


   .. zeek:field:: ntlmssp :zeek:type:`count`

      The current revision of NTLMSSP in use



.. zeek:type:: NTP::ControlMessage
   :source-code: base/init-bare.zeek 6098 6132

   :Type: :zeek:type:`record`


   .. zeek:field:: op_code :zeek:type:`count`

      An integer specifying the command function. Values currently defined:

      * 1 read status command/response
      * 2 read variables command/response
      * 3 write variables command/response
      * 4 read clock variables command/response
      * 5 write clock variables command/response
      * 6 set trap address/port command/response
      * 7 trap response

      Other values are reserved.


   .. zeek:field:: resp_bit :zeek:type:`bool`

      The response bit. Set to zero for commands, one for responses.


   .. zeek:field:: err_bit :zeek:type:`bool`

      The error bit. Set to zero for normal response, one for error
      response.


   .. zeek:field:: more_bit :zeek:type:`bool`

      The more bit. Set to zero for last fragment, one for all others.


   .. zeek:field:: sequence :zeek:type:`count`

      The sequence number of the command or response.


   .. zeek:field:: status :zeek:type:`count`

      The current status of the system, peer or clock.


   .. zeek:field:: association_id :zeek:type:`count`

      A 16-bit integer identifying a valid association.


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      Message data for the command or response + Authenticator (optional).


   .. zeek:field:: key_id :zeek:type:`count` :zeek:attr:`&optional`

      This is an integer identifying the cryptographic
      key used to generate the message-authentication code.


   .. zeek:field:: crypto_checksum :zeek:type:`string` :zeek:attr:`&optional`

      This is a crypto-checksum computed by the encryption procedure.


   NTP control message as defined in :rfc:`1119` for mode=6
   This record contains the fields used by the NTP protocol
   for control operations.

.. zeek:type:: NTP::Message
   :source-code: base/init-bare.zeek 6179 6206

   :Type: :zeek:type:`record`


   .. zeek:field:: version :zeek:type:`count`

      The NTP version number (1, 2, 3, 4).


   .. zeek:field:: mode :zeek:type:`count`

      The NTP mode being used. Possible values are:

        * 1 - symmetric active
        * 2 - symmetric passive
        * 3 - client
        * 4 - server
        * 5 - broadcast
        * 6 - NTP control message
        * 7 - reserved for private use


   .. zeek:field:: std_msg :zeek:type:`NTP::StandardMessage` :zeek:attr:`&optional`

      If mode 1-5, the standard fields for synchronization operations are
      here.  See :rfc:`5905`


   .. zeek:field:: control_msg :zeek:type:`NTP::ControlMessage` :zeek:attr:`&optional`

      If mode 6, the fields for control operations are here.
      See :rfc:`1119`


   .. zeek:field:: mode7_msg :zeek:type:`NTP::Mode7Message` :zeek:attr:`&optional`

      If mode 7, the fields for extra operations are here.
      Note that this is not defined in any RFC
      and is implementation dependent. We used the official implementation
      from the `NTP official project <https://www.ntp.org>`_.
      A mode 7 packet is used exchanging data between an NTP server
      and a client for purposes other than time synchronization, e.g.
      monitoring, statistics gathering and configuration.


   NTP message as defined in :rfc:`5905`.  Does include fields for mode 7,
   reserved for private use in :rfc:`5905`, but used in some implementation
   for commands such as "monlist".

.. zeek:type:: NTP::Mode7Message
   :source-code: base/init-bare.zeek 6141 6174

   :Type: :zeek:type:`record`


   .. zeek:field:: req_code :zeek:type:`count`

      An implementation-specific code which specifies the
      operation to be (which has been) performed and/or the
      format and semantics of the data included in the packet.


   .. zeek:field:: auth_bit :zeek:type:`bool`

      The authenticated bit. If set, this packet is authenticated.


   .. zeek:field:: sequence :zeek:type:`count`

      For a multipacket response, contains the sequence
      number of this packet.  0 is the first in the sequence,
      127 (or less) is the last.  The More Bit must be set in
      all packets but the last.


   .. zeek:field:: implementation :zeek:type:`count`

      The number of the implementation this request code
      is defined by.  An implementation number of zero is used
      for request codes/data formats which all implementations
      agree on.  Implementation number 255 is reserved (for
      extensions, in case we run out).


   .. zeek:field:: err :zeek:type:`count`

      Must be 0 for a request.  For a response, holds an error
      code relating to the request.  If nonzero, the operation
      requested wasn't performed.

        * 0 - no error
        * 1 - incompatible implementation number
        * 2 - unimplemented request code
        * 3 - format error (wrong data items, data size, packet size etc.)
        * 4 - no data available (e.g. request for details on unknown peer)
        * 5 - unknown
        * 6 - unknown
        * 7 - authentication failure (i.e. permission denied)


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      Rest of data


   NTP mode 7 message. Note that this is not defined in any RFC and is
   implementation dependent. We used the official implementation from the
   `NTP official project <https://www.ntp.org>`_.  A mode 7 packet is used
   exchanging data between an NTP server and a client for purposes other
   than time synchronization, e.g.  monitoring, statistics gathering and
   configuration.  For details see the documentation from the `NTP official
   project <https://www.ntp.org>`_, code v. ntp-4.2.8p13, in include/ntp_request.h.

.. zeek:type:: NTP::StandardMessage
   :source-code: base/init-bare.zeek 6040 6093

   :Type: :zeek:type:`record`


   .. zeek:field:: stratum :zeek:type:`count`

      This value mainly identifies the type of server (primary server,
      secondary server, etc.). Possible values, as in :rfc:`5905`, are:

        * 0 -> unspecified or invalid
        * 1 -> primary server (e.g., equipped with a GPS receiver)
        * 2-15 -> secondary server (via NTP)
        * 16 -> unsynchronized
        * 17-255 -> reserved

      For stratum 0, a *kiss_code* can be given for debugging and
      monitoring.


   .. zeek:field:: poll :zeek:type:`interval`

      The maximum interval between successive messages.


   .. zeek:field:: precision :zeek:type:`interval`

      The precision of the system clock.


   .. zeek:field:: root_delay :zeek:type:`interval`

      Root delay. The total round-trip delay to the reference clock.


   .. zeek:field:: root_disp :zeek:type:`interval`

      Root Dispersion. The total dispersion to the reference clock.


   .. zeek:field:: kiss_code :zeek:type:`string` :zeek:attr:`&optional`

      For stratum 0, four-character ASCII string used for debugging and
      monitoring. Values are defined in :rfc:`1345`.


   .. zeek:field:: ref_id :zeek:type:`string` :zeek:attr:`&optional`

      Reference ID. For stratum 1, this is the ID assigned to the
      reference clock by IANA.
      For example: GOES, GPS, GAL, etc. (see :rfc:`5905`)


   .. zeek:field:: ref_addr :zeek:type:`addr` :zeek:attr:`&optional`

      Above stratum 1, when using IPv4, the IP address of the reference
      clock.  Note that the NTP protocol did not originally specify a
      large enough field to represent IPv6 addresses, so they use
      the first four bytes of the MD5 hash of the reference clock's
      IPv6 address (i.e. an IPv4 address here is not necessarily IPv4).


   .. zeek:field:: ref_time :zeek:type:`time`

      Reference timestamp. Time when the system clock was last set or
      correct.


   .. zeek:field:: org_time :zeek:type:`time`

      Origin timestamp. Time at the client when the request departed for
      the NTP server.


   .. zeek:field:: rec_time :zeek:type:`time`

      Receive timestamp. Time at the server when the request arrived from
      the NTP client.


   .. zeek:field:: xmt_time :zeek:type:`time`

      Transmit timestamp. Time at the server when the response departed


   .. zeek:field:: key_id :zeek:type:`count` :zeek:attr:`&optional`

      Key used to designate a secret MD5 key.


   .. zeek:field:: digest :zeek:type:`string` :zeek:attr:`&optional`

      MD5 hash computed over the key followed by the NTP packet header and
      extension fields.


   .. zeek:field:: num_exts :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Number of extension fields (which are not currently parsed).


   NTP standard message as defined in :rfc:`5905` for modes 1-5
   This record contains the standard fields used by the NTP protocol
   for standard synchronization operations.

.. zeek:type:: NetStats
   :source-code: base/init-bare.zeek 1175 1186

   :Type: :zeek:type:`record`


   .. zeek:field:: pkts_recvd :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Packets received by Zeek.


   .. zeek:field:: pkts_dropped :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Packets reported dropped by the system.


   .. zeek:field:: pkts_link :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Packets seen on the link. Note that this may differ
      from *pkts_recvd* because of a potential capture_filter. See
      :doc:`/scripts/base/frameworks/packet-filter/main.zeek`. Depending on the
      packet capture system, this value may not be available and will then
      be always set to zero.


   .. zeek:field:: bytes_recvd :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Bytes received by Zeek.


   .. zeek:field:: pkts_filtered :zeek:type:`count` :zeek:attr:`&optional`

      Packets filtered by the packet source.


   Packet capture statistics.  All counts are cumulative.

   .. zeek:see:: get_net_stats

.. zeek:type:: PE::DOSHeader
   :source-code: base/init-bare.zeek 5144 5180

   :Type: :zeek:type:`record`


   .. zeek:field:: signature :zeek:type:`string`

      The magic number of a portable executable file ("MZ").


   .. zeek:field:: used_bytes_in_last_page :zeek:type:`count`

      The number of bytes in the last page that are used.


   .. zeek:field:: file_in_pages :zeek:type:`count`

      The number of pages in the file that are part of the PE file itself.


   .. zeek:field:: num_reloc_items :zeek:type:`count`

      Number of relocation entries stored after the header.


   .. zeek:field:: header_in_paragraphs :zeek:type:`count`

      Number of paragraphs in the header.


   .. zeek:field:: min_extra_paragraphs :zeek:type:`count`

      Number of paragraphs of additional memory that the program will need.


   .. zeek:field:: max_extra_paragraphs :zeek:type:`count`

      Maximum number of paragraphs of additional memory.


   .. zeek:field:: init_relative_ss :zeek:type:`count`

      Relative value of the stack segment.


   .. zeek:field:: init_sp :zeek:type:`count`

      Initial value of the SP register.


   .. zeek:field:: checksum :zeek:type:`count`

      Checksum. The 16-bit sum of all words in the file should be 0. Normally not set.


   .. zeek:field:: init_ip :zeek:type:`count`

      Initial value of the IP register.


   .. zeek:field:: init_relative_cs :zeek:type:`count`

      Initial value of the CS register (relative to the initial segment).


   .. zeek:field:: addr_of_reloc_table :zeek:type:`count`

      Offset of the first relocation table.


   .. zeek:field:: overlay_num :zeek:type:`count`

      Overlays allow you to append data to the end of the file. If this is the main program,
      this will be 0.


   .. zeek:field:: oem_id :zeek:type:`count`

      OEM identifier.


   .. zeek:field:: oem_info :zeek:type:`count`

      Additional OEM info, specific to oem_id.


   .. zeek:field:: addr_of_new_exe_header :zeek:type:`count`

      Address of the new EXE header.



.. zeek:type:: PE::FileHeader
   :source-code: base/init-bare.zeek 5182 5195

   :Type: :zeek:type:`record`


   .. zeek:field:: machine :zeek:type:`count`

      The target machine that the file was compiled for.


   .. zeek:field:: ts :zeek:type:`time`

      The time that the file was created at.


   .. zeek:field:: sym_table_ptr :zeek:type:`count`

      Pointer to the symbol table.


   .. zeek:field:: num_syms :zeek:type:`count`

      Number of symbols.


   .. zeek:field:: optional_header_size :zeek:type:`count`

      The size of the optional header.


   .. zeek:field:: characteristics :zeek:type:`set` [:zeek:type:`count`]

      Bit flags that determine if this file is executable, non-relocatable, and/or a DLL.



.. zeek:type:: PE::OptionalHeader
   :source-code: base/init-bare.zeek 5197 5248

   :Type: :zeek:type:`record`


   .. zeek:field:: magic :zeek:type:`count`

      PE32 or PE32+ indicator.


   .. zeek:field:: major_linker_version :zeek:type:`count`

      The major version of the linker used to create the PE.


   .. zeek:field:: minor_linker_version :zeek:type:`count`

      The minor version of the linker used to create the PE.


   .. zeek:field:: size_of_code :zeek:type:`count`

      Size of the .text section.


   .. zeek:field:: size_of_init_data :zeek:type:`count`

      Size of the .data section.


   .. zeek:field:: size_of_uninit_data :zeek:type:`count`

      Size of the .bss section.


   .. zeek:field:: addr_of_entry_point :zeek:type:`count`

      The relative virtual address (RVA) of the entry point.


   .. zeek:field:: base_of_code :zeek:type:`count`

      The relative virtual address (RVA) of the .text section.


   .. zeek:field:: base_of_data :zeek:type:`count` :zeek:attr:`&optional`

      The relative virtual address (RVA) of the .data section.


   .. zeek:field:: image_base :zeek:type:`count`

      Preferred memory location for the image to be based at.


   .. zeek:field:: section_alignment :zeek:type:`count`

      The alignment (in bytes) of sections when they're loaded in memory.


   .. zeek:field:: file_alignment :zeek:type:`count`

      The alignment (in bytes) of the raw data of sections.


   .. zeek:field:: os_version_major :zeek:type:`count`

      The major version of the required OS.


   .. zeek:field:: os_version_minor :zeek:type:`count`

      The minor version of the required OS.


   .. zeek:field:: major_image_version :zeek:type:`count`

      The major version of this image.


   .. zeek:field:: minor_image_version :zeek:type:`count`

      The minor version of this image.


   .. zeek:field:: major_subsys_version :zeek:type:`count`

      The major version of the subsystem required to run this file.


   .. zeek:field:: minor_subsys_version :zeek:type:`count`

      The minor version of the subsystem required to run this file.


   .. zeek:field:: size_of_image :zeek:type:`count`

      The size (in bytes) of the image as the image is loaded in memory.


   .. zeek:field:: size_of_headers :zeek:type:`count`

      The size (in bytes) of the headers, rounded up to file_alignment.


   .. zeek:field:: checksum :zeek:type:`count`

      The image file checksum.


   .. zeek:field:: subsystem :zeek:type:`count`

      The subsystem that's required to run this image.


   .. zeek:field:: dll_characteristics :zeek:type:`set` [:zeek:type:`count`]

      Bit flags that determine how to execute or load this file.


   .. zeek:field:: table_sizes :zeek:type:`vector` of :zeek:type:`count`

      A vector with the sizes of various tables and strings that are
      defined in the optional header data directories. Examples include
      the import table, the resource table, and debug information.



.. zeek:type:: PE::SectionHeader
   :source-code: base/init-bare.zeek 5252 5277

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      The name of the section


   .. zeek:field:: virtual_size :zeek:type:`count`

      The total size of the section when loaded into memory.


   .. zeek:field:: virtual_addr :zeek:type:`count`

      The relative virtual address (RVA) of the section.


   .. zeek:field:: size_of_raw_data :zeek:type:`count`

      The size of the initialized data for the section, as it is
      in the file on disk.


   .. zeek:field:: ptr_to_raw_data :zeek:type:`count`

      The virtual address of the initialized dat for the section,
      as it is in the file on disk.


   .. zeek:field:: ptr_to_relocs :zeek:type:`count`

      The file pointer to the beginning of relocation entries for
      the section.


   .. zeek:field:: ptr_to_line_nums :zeek:type:`count`

      The file pointer to the beginning of line-number entries for
      the section.


   .. zeek:field:: num_of_relocs :zeek:type:`count`

      The number of relocation entries for the section.


   .. zeek:field:: num_of_line_nums :zeek:type:`count`

      The number of line-number entries for the section.


   .. zeek:field:: characteristics :zeek:type:`set` [:zeek:type:`count`]

      Bit-flags that describe the characteristics of the section.


   Record for Portable Executable (PE) section headers.

.. zeek:type:: PacketSource
   :source-code: base/init-bare.zeek 159 169

   :Type: :zeek:type:`record`


   .. zeek:field:: live :zeek:type:`bool`

      Whether the packet source is a live interface or offline pcap file.


   .. zeek:field:: path :zeek:type:`string`

      The interface name for a live interface or filesystem path of
      an offline pcap file.


   .. zeek:field:: link_type :zeek:type:`int`

      The data link-layer type of the packet source.


   .. zeek:field:: netmask :zeek:type:`count`

      The netmask associated with the source or ``NETMASK_UNKNOWN``.


   Properties of an I/O packet source being read by Zeek.

.. zeek:type:: Pcap::Interface
   :source-code: base/init-bare.zeek 5961 5976

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      The interface/device name.


   .. zeek:field:: description :zeek:type:`string` :zeek:attr:`&optional`

      A human-readable description of the device.


   .. zeek:field:: addrs :zeek:type:`set` [:zeek:type:`addr`]

      The network addresses associated with the device.


   .. zeek:field:: is_loopback :zeek:type:`bool`

      Whether the device is a loopback interface.  E.g. addresses
      of ``127.0.0.1`` or ``[::1]`` are used by loopback interfaces.


   .. zeek:field:: is_up :zeek:type:`bool` :zeek:attr:`&optional`

      Whether the device is up.  Not set when that info is unavailable.


   .. zeek:field:: is_running :zeek:type:`bool` :zeek:attr:`&optional`

      Whether the device is running.  Not set when that info is unavailable.


   The definition of a "pcap interface".

.. zeek:type:: Pcap::Interfaces
   :source-code: base/init-bare.zeek 5978 5978

   :Type: :zeek:type:`set` [:zeek:type:`Pcap::Interface`]


.. zeek:type:: Pcap::filter_state
   :source-code: base/init-bare.zeek 5981 5986

   :Type: :zeek:type:`enum`

      .. zeek:enum:: Pcap::ok Pcap::filter_state

      .. zeek:enum:: Pcap::fatal Pcap::filter_state

      .. zeek:enum:: Pcap::warning Pcap::filter_state

   The state of the compilation for a pcap filter.

.. zeek:type:: PcapFilterID
   :source-code: base/init-bare.zeek 1538 1539

   :Type: :zeek:type:`enum`

      .. zeek:enum:: None PcapFilterID

      .. zeek:enum:: PacketFilter::DefaultPcapFilter PcapFilterID

         (present if :doc:`/scripts/base/frameworks/packet-filter/main.zeek` is loaded)


      .. zeek:enum:: PacketFilter::FilterTester PcapFilterID

         (present if :doc:`/scripts/base/frameworks/packet-filter/main.zeek` is loaded)


   Enum type identifying dynamic BPF filters. These are used by
   :zeek:see:`Pcap::precompile_pcap_filter` and :zeek:see:`Pcap::precompile_pcap_filter`.

.. zeek:type:: PluginComponent
   :source-code: base/init-bare.zeek 419 424

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`


   .. zeek:field:: canonical_name :zeek:type:`string`


   .. zeek:field:: tag :zeek:type:`string`


   .. zeek:field:: enabled :zeek:type:`bool`


   Record containing information about a tag.

   .. zeek:see:: get_plugin_components

.. zeek:type:: ProcStats
   :source-code: base/init-bare.zeek 1219 1232

   :Type: :zeek:type:`record`


   .. zeek:field:: debug :zeek:type:`bool`

      True if compiled with --enable-debug.


   .. zeek:field:: start_time :zeek:type:`time`

      Start time of process.


   .. zeek:field:: real_time :zeek:type:`interval`

      Elapsed real time since Zeek started running.


   .. zeek:field:: user_time :zeek:type:`interval`

      User CPU seconds.


   .. zeek:field:: system_time :zeek:type:`interval`

      System CPU seconds.


   .. zeek:field:: mem :zeek:type:`count`

      Maximum memory consumed, in bytes.


   .. zeek:field:: minor_faults :zeek:type:`count`

      Page faults not requiring actual I/O.


   .. zeek:field:: major_faults :zeek:type:`count`

      Page faults requiring actual I/O.


   .. zeek:field:: num_swap :zeek:type:`count`

      Times swapped out.


   .. zeek:field:: blocking_input :zeek:type:`count`

      Blocking input operations.


   .. zeek:field:: blocking_output :zeek:type:`count`

      Blocking output operations.


   .. zeek:field:: num_context :zeek:type:`count`

      Number of involuntary context switches.


   Statistics about Zeek's process.

   .. zeek:see:: get_proc_stats

   .. note:: All process-level values refer to Zeek's main process only, not to
      the child process it spawns for doing communication.

.. zeek:type:: RADIUS::AttributeList
   :source-code: base/init-bare.zeek 5385 5385

   :Type: :zeek:type:`vector` of :zeek:type:`string`


.. zeek:type:: RADIUS::Attributes
   :source-code: base/init-bare.zeek 5386 5386

   :Type: :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`RADIUS::AttributeList`


.. zeek:type:: RADIUS::Message
   :source-code: base/init-bare.zeek 5388 5397

   :Type: :zeek:type:`record`


   .. zeek:field:: code :zeek:type:`count`

      The type of message (Access-Request, Access-Accept, etc.).


   .. zeek:field:: trans_id :zeek:type:`count`

      The transaction ID.


   .. zeek:field:: authenticator :zeek:type:`string`

      The "authenticator" string.


   .. zeek:field:: attributes :zeek:type:`RADIUS::Attributes` :zeek:attr:`&optional`

      Any attributes.



.. zeek:type:: RDP::ClientChannelDef
   :source-code: base/init-bare.zeek 5455 5483

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      A unique name for the channel


   .. zeek:field:: options :zeek:type:`count`

      Channel Def raw options as count


   .. zeek:field:: initialized :zeek:type:`bool`

      Absence of this flag indicates that this channel is
      a placeholder and that the server MUST NOT set it up.


   .. zeek:field:: encrypt_rdp :zeek:type:`bool`

      Unused, must be ignored by the server.


   .. zeek:field:: encrypt_sc :zeek:type:`bool`

      Unused, must be ignored by the server.


   .. zeek:field:: encrypt_cs :zeek:type:`bool`

      Unused, must be ignored by the server.


   .. zeek:field:: pri_high :zeek:type:`bool`

      Channel data must be sent with high MCS priority.


   .. zeek:field:: pri_med :zeek:type:`bool`

      Channel data must be sent with medium MCS priority.


   .. zeek:field:: pri_low :zeek:type:`bool`

      Channel data must be sent with low MCS priority.


   .. zeek:field:: compress_rdp :zeek:type:`bool`

      Virtual channel data must be compressed if RDP data is being compressed.


   .. zeek:field:: compress :zeek:type:`bool`

      Virtual channel data must be compressed.


   .. zeek:field:: show_protocol :zeek:type:`bool`

      Ignored by the server.


   .. zeek:field:: persistent :zeek:type:`bool`

      Channel must be persistent across remote control transactions.


   Name and flags for a single channel requested by the client.

.. zeek:type:: RDP::ClientChannelList
   :source-code: base/init-bare.zeek 5510 5510

   :Type: :zeek:type:`vector` of :zeek:type:`RDP::ClientChannelDef`

   The list of channels requested by the client.

.. zeek:type:: RDP::ClientClusterData
   :source-code: base/init-bare.zeek 5488 5507

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`count`

      Cluster information flags.


   .. zeek:field:: redir_session_id :zeek:type:`count`

      If the *redir_sessionid_field_valid* flag is set, this field
      contains a valid session identifier to which the client requests
      to connect.


   .. zeek:field:: redir_supported :zeek:type:`bool`

      The client can receive server session redirection packets.
      If this flag is set, the *svr_session_redir_version_mask*
      field MUST contain the server session redirection version that
      the client supports.


   .. zeek:field:: svr_session_redir_version_mask :zeek:type:`count`

      The server session redirection version that the client supports.


   .. zeek:field:: redir_sessionid_field_valid :zeek:type:`bool`

      Whether the *redir_session_id* field identifies a session on
      the server to associate with the connection.


   .. zeek:field:: redir_smartcard :zeek:type:`bool`

      The client logged on with a smart card.


   The TS_UD_CS_CLUSTER data block is sent by the client to the server
   either to advertise that it can support the Server Redirection PDUs
   or to request a connection to a given session identifier.

.. zeek:type:: RDP::ClientCoreData
   :source-code: base/init-bare.zeek 5415 5436

   :Type: :zeek:type:`record`


   .. zeek:field:: version_major :zeek:type:`count`


   .. zeek:field:: version_minor :zeek:type:`count`


   .. zeek:field:: desktop_width :zeek:type:`count`


   .. zeek:field:: desktop_height :zeek:type:`count`


   .. zeek:field:: color_depth :zeek:type:`count`


   .. zeek:field:: sas_sequence :zeek:type:`count`


   .. zeek:field:: keyboard_layout :zeek:type:`count`


   .. zeek:field:: client_build :zeek:type:`count`


   .. zeek:field:: client_name :zeek:type:`string`


   .. zeek:field:: keyboard_type :zeek:type:`count`


   .. zeek:field:: keyboard_sub :zeek:type:`count`


   .. zeek:field:: keyboard_function_key :zeek:type:`count`


   .. zeek:field:: ime_file_name :zeek:type:`string`


   .. zeek:field:: post_beta2_color_depth :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: client_product_id :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: serial_number :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: high_color_depth :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: supported_color_depths :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: ec_flags :zeek:type:`RDP::EarlyCapabilityFlags` :zeek:attr:`&optional`


   .. zeek:field:: dig_product_id :zeek:type:`string` :zeek:attr:`&optional`



.. zeek:type:: RDP::ClientSecurityData
   :source-code: base/init-bare.zeek 5440 5452

   :Type: :zeek:type:`record`


   .. zeek:field:: encryption_methods :zeek:type:`count`

      Cryptographic encryption methods supported by the client and used in
      conjunction with Standard RDP Security.  Known flags:

      - 0x00000001: support for 40-bit session encryption keys
      - 0x00000002: support for 128-bit session encryption keys
      - 0x00000008: support for 56-bit session encryption keys
      - 0x00000010: support for FIPS compliant encryption and MAC methods


   .. zeek:field:: ext_encryption_methods :zeek:type:`count`

      Only used in French locale and designates the encryption method.  If
      non-zero, then encryption_methods should be set to 0.


   The TS_UD_CS_SEC data block contains security-related information used
   to advertise client cryptographic support.

.. zeek:type:: RDP::EarlyCapabilityFlags
   :source-code: base/init-bare.zeek 5403 5413

   :Type: :zeek:type:`record`


   .. zeek:field:: support_err_info_pdu :zeek:type:`bool`


   .. zeek:field:: want_32bpp_session :zeek:type:`bool`


   .. zeek:field:: support_statusinfo_pdu :zeek:type:`bool`


   .. zeek:field:: strong_asymmetric_keys :zeek:type:`bool`


   .. zeek:field:: support_monitor_layout_pdu :zeek:type:`bool`


   .. zeek:field:: support_netchar_autodetect :zeek:type:`bool`


   .. zeek:field:: support_dynvc_gfx_protocol :zeek:type:`bool`


   .. zeek:field:: support_dynamic_time_zone :zeek:type:`bool`


   .. zeek:field:: support_heartbeat_pdu :zeek:type:`bool`



.. zeek:type:: ReassemblerStats
   :source-code: base/init-bare.zeek 1242 1247

   :Type: :zeek:type:`record`


   .. zeek:field:: file_size :zeek:type:`count`

      Byte size of File reassembly tracking.


   .. zeek:field:: frag_size :zeek:type:`count`

      Byte size of Fragment reassembly tracking.


   .. zeek:field:: tcp_size :zeek:type:`count`

      Byte size of TCP reassembly tracking.


   .. zeek:field:: unknown_size :zeek:type:`count`

      Byte size of reassembly tracking for unknown purposes.


   Holds statistics for all types of reassembly.

   .. zeek:see:: get_reassembler_stats

.. zeek:type:: ReporterStats
   :source-code: base/init-bare.zeek 1353 1359

   :Type: :zeek:type:`record`


   .. zeek:field:: weirds :zeek:type:`count`

      Number of total weirds encountered, before any rate-limiting.


   .. zeek:field:: weirds_by_type :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`count`

      Number of times each individual weird is encountered, before any
      rate-limiting is applied.


   Statistics about reporter messages and weirds.

   .. zeek:see:: get_reporter_stats

.. zeek:type:: SMB1::Find_First2_Request_Args
   :source-code: base/init-bare.zeek 4602 4616

   :Type: :zeek:type:`record`


   .. zeek:field:: search_attrs :zeek:type:`count`

      File attributes to apply as a constraint to the search


   .. zeek:field:: search_count :zeek:type:`count`

      Max search results


   .. zeek:field:: flags :zeek:type:`count`

      Misc. flags for how the server should manage the transaction
      once results are returned


   .. zeek:field:: info_level :zeek:type:`count`

      How detailed the information returned in the results should be


   .. zeek:field:: search_storage_type :zeek:type:`count`

      Specify whether to search for directories or files


   .. zeek:field:: file_name :zeek:type:`string`

      The string to search for (note: may contain wildcards)



.. zeek:type:: SMB1::Find_First2_Response_Args
   :source-code: base/init-bare.zeek 4618 4628

   :Type: :zeek:type:`record`


   .. zeek:field:: sid :zeek:type:`count`

      The server generated search identifier


   .. zeek:field:: search_count :zeek:type:`count`

      Number of results returned by the search


   .. zeek:field:: end_of_search :zeek:type:`bool`

      Whether or not the search can be continued using
      the TRANS2_FIND_NEXT2 transaction


   .. zeek:field:: ext_attr_error :zeek:type:`string` :zeek:attr:`&optional`

      An extended attribute name that couldn't be retrieved



.. zeek:type:: SMB1::Header
   :source-code: base/init-bare.zeek 4299 4308

   :Type: :zeek:type:`record`


   .. zeek:field:: command :zeek:type:`count`

      The command number


   .. zeek:field:: status :zeek:type:`count`

      The status code


   .. zeek:field:: flags :zeek:type:`count`

      Flag set 1


   .. zeek:field:: flags2 :zeek:type:`count`

      Flag set 2


   .. zeek:field:: tid :zeek:type:`count`

      Tree ID


   .. zeek:field:: pid :zeek:type:`count`

      Process ID


   .. zeek:field:: uid :zeek:type:`count`

      User ID


   .. zeek:field:: mid :zeek:type:`count`

      Multiplex ID


   An SMB1 header.

   .. zeek:see:: smb1_message smb1_empty_response smb1_error
      smb1_check_directory_request smb1_check_directory_response
      smb1_close_request smb1_create_directory_request
      smb1_create_directory_response smb1_echo_request
      smb1_echo_response smb1_negotiate_request
      smb1_negotiate_response smb1_nt_cancel_request
      smb1_nt_create_andx_request smb1_nt_create_andx_response
      smb1_query_information_request smb1_read_andx_request
      smb1_read_andx_response smb1_session_setup_andx_request
      smb1_session_setup_andx_response smb1_transaction_request
      smb1_transaction2_request smb1_trans2_find_first2_request
      smb1_trans2_query_path_info_request
      smb1_trans2_get_dfs_referral_request
      smb1_tree_connect_andx_request smb1_tree_connect_andx_response
      smb1_tree_disconnect smb1_write_andx_request
      smb1_write_andx_response

.. zeek:type:: SMB1::NegotiateCapabilities
   :source-code: base/init-bare.zeek 4317 4359

   :Type: :zeek:type:`record`


   .. zeek:field:: raw_mode :zeek:type:`bool`

      The server supports SMB_COM_READ_RAW and SMB_COM_WRITE_RAW


   .. zeek:field:: mpx_mode :zeek:type:`bool`

      The server supports SMB_COM_READ_MPX and SMB_COM_WRITE_MPX


   .. zeek:field:: unicode :zeek:type:`bool`

      The server supports unicode strings


   .. zeek:field:: large_files :zeek:type:`bool`

      The server supports large files with 64 bit offsets


   .. zeek:field:: nt_smbs :zeek:type:`bool`

      The server supports the SMBs particular to the NT LM 0.12 dialect. Implies nt_find.


   .. zeek:field:: rpc_remote_apis :zeek:type:`bool`

      The server supports remote admin API requests via DCE-RPC


   .. zeek:field:: status32 :zeek:type:`bool`

      The server can respond with 32 bit status codes in Status.Status


   .. zeek:field:: level_2_oplocks :zeek:type:`bool`

      The server supports level 2 oplocks


   .. zeek:field:: lock_and_read :zeek:type:`bool`

      The server supports SMB_COM_LOCK_AND_READ


   .. zeek:field:: nt_find :zeek:type:`bool`

      Reserved


   .. zeek:field:: dfs :zeek:type:`bool`

      The server is DFS aware


   .. zeek:field:: infolevel_passthru :zeek:type:`bool`

      The server supports NT information level requests passing through


   .. zeek:field:: large_readx :zeek:type:`bool`

      The server supports large SMB_COM_READ_ANDX (up to 64k)


   .. zeek:field:: large_writex :zeek:type:`bool`

      The server supports large SMB_COM_WRITE_ANDX (up to 64k)


   .. zeek:field:: unix :zeek:type:`bool`

      The server supports CIFS Extensions for UNIX


   .. zeek:field:: bulk_transfer :zeek:type:`bool`

      The server supports SMB_BULK_READ, SMB_BULK_WRITE
      Note: No known implementations support this


   .. zeek:field:: compressed_data :zeek:type:`bool`

      The server supports compressed data transfer. Requires bulk_transfer.
      Note: No known implementations support this


   .. zeek:field:: extended_security :zeek:type:`bool`

      The server supports extended security exchanges



.. zeek:type:: SMB1::NegotiateRawMode
   :source-code: base/init-bare.zeek 4310 4315

   :Type: :zeek:type:`record`


   .. zeek:field:: read_raw :zeek:type:`bool`

      Read raw supported


   .. zeek:field:: write_raw :zeek:type:`bool`

      Write raw supported



.. zeek:type:: SMB1::NegotiateResponse
   :source-code: base/init-bare.zeek 4449 4458

   :Type: :zeek:type:`record`


   .. zeek:field:: core :zeek:type:`SMB1::NegotiateResponseCore` :zeek:attr:`&optional`

      If the server does not understand any of the dialect strings, or if
      PC NETWORK PROGRAM 1.0 is the chosen dialect.


   .. zeek:field:: lanman :zeek:type:`SMB1::NegotiateResponseLANMAN` :zeek:attr:`&optional`

      If the chosen dialect is greater than core up to and including
      LANMAN 2.1.


   .. zeek:field:: ntlm :zeek:type:`SMB1::NegotiateResponseNTLM` :zeek:attr:`&optional`

      If the chosen dialect is NT LM 0.12.



.. zeek:type:: SMB1::NegotiateResponseCore
   :source-code: base/init-bare.zeek 4378 4381

   :Type: :zeek:type:`record`


   .. zeek:field:: dialect_index :zeek:type:`count`

      Index of selected dialect



.. zeek:type:: SMB1::NegotiateResponseLANMAN
   :source-code: base/init-bare.zeek 4383 4409

   :Type: :zeek:type:`record`


   .. zeek:field:: word_count :zeek:type:`count`

      Count of parameter words (should be 13)


   .. zeek:field:: dialect_index :zeek:type:`count`

      Index of selected dialect


   .. zeek:field:: security_mode :zeek:type:`SMB1::NegotiateResponseSecurity`

      Security mode


   .. zeek:field:: max_buffer_size :zeek:type:`count`

      Max transmit buffer size (>= 1024)


   .. zeek:field:: max_mpx_count :zeek:type:`count`

      Max pending multiplexed requests


   .. zeek:field:: max_number_vcs :zeek:type:`count`

      Max number of virtual circuits (VCs - transport-layer connections)
      between client and server


   .. zeek:field:: raw_mode :zeek:type:`SMB1::NegotiateRawMode`

      Raw mode


   .. zeek:field:: session_key :zeek:type:`count`

      Unique token identifying this session


   .. zeek:field:: server_time :zeek:type:`time`

      Current date and time at server


   .. zeek:field:: encryption_key :zeek:type:`string`

      The challenge encryption key


   .. zeek:field:: primary_domain :zeek:type:`string`

      The server's primary domain



.. zeek:type:: SMB1::NegotiateResponseNTLM
   :source-code: base/init-bare.zeek 4411 4447

   :Type: :zeek:type:`record`


   .. zeek:field:: word_count :zeek:type:`count`

      Count of parameter words (should be 17)


   .. zeek:field:: dialect_index :zeek:type:`count`

      Index of selected dialect


   .. zeek:field:: security_mode :zeek:type:`SMB1::NegotiateResponseSecurity`

      Security mode


   .. zeek:field:: max_buffer_size :zeek:type:`count`

      Max transmit buffer size


   .. zeek:field:: max_mpx_count :zeek:type:`count`

      Max pending multiplexed requests


   .. zeek:field:: max_number_vcs :zeek:type:`count`

      Max number of virtual circuits (VCs - transport-layer connections)
      between client and server


   .. zeek:field:: max_raw_size :zeek:type:`count`

      Max raw buffer size


   .. zeek:field:: session_key :zeek:type:`count`

      Unique token identifying this session


   .. zeek:field:: capabilities :zeek:type:`SMB1::NegotiateCapabilities`

      Server capabilities


   .. zeek:field:: server_time :zeek:type:`time`

      Current date and time at server


   .. zeek:field:: encryption_key :zeek:type:`string` :zeek:attr:`&optional`

      The challenge encryption key.
      Present only for non-extended security (i.e. capabilities$extended_security = F)


   .. zeek:field:: domain_name :zeek:type:`string` :zeek:attr:`&optional`

      The name of the domain.
      Present only for non-extended security (i.e. capabilities$extended_security = F)


   .. zeek:field:: guid :zeek:type:`string` :zeek:attr:`&optional`

      A globally unique identifier assigned to the server.
      Present only for extended security (i.e. capabilities$extended_security = T)


   .. zeek:field:: security_blob :zeek:type:`string`

      Opaque security blob associated with the security package if capabilities$extended_security = T
      Otherwise, the challenge for challenge/response authentication.



.. zeek:type:: SMB1::NegotiateResponseSecurity
   :source-code: base/init-bare.zeek 4361 4376

   :Type: :zeek:type:`record`


   .. zeek:field:: user_level :zeek:type:`bool`

      This indicates whether the server, as a whole, is operating under
      Share Level or User Level security.


   .. zeek:field:: challenge_response :zeek:type:`bool`

      This indicates whether or not the server supports Challenge/Response
      authentication. If the bit is false, then plaintext passwords must
      be used.


   .. zeek:field:: signatures_enabled :zeek:type:`bool` :zeek:attr:`&optional`

      This indicates if the server is capable of performing MAC message
      signing. Note: Requires NT LM 0.12 or later.


   .. zeek:field:: signatures_required :zeek:type:`bool` :zeek:attr:`&optional`

      This indicates if the server is requiring the use of a MAC in each
      packet. If false, message signing is optional. Note: Requires NT LM 0.12
      or later.



.. zeek:type:: SMB1::SessionSetupAndXCapabilities
   :source-code: base/init-bare.zeek 4460 4474

   :Type: :zeek:type:`record`


   .. zeek:field:: unicode :zeek:type:`bool`

      The client can use unicode strings


   .. zeek:field:: large_files :zeek:type:`bool`

      The client can deal with files having 64 bit offsets


   .. zeek:field:: nt_smbs :zeek:type:`bool`

      The client understands the SMBs introduced with NT LM 0.12
      Implies nt_find


   .. zeek:field:: status32 :zeek:type:`bool`

      The client can receive 32 bit errors encoded in Status.Status


   .. zeek:field:: level_2_oplocks :zeek:type:`bool`

      The client understands Level II oplocks


   .. zeek:field:: nt_find :zeek:type:`bool`

      Reserved. Implied by nt_smbs.



.. zeek:type:: SMB1::SessionSetupAndXRequest
   :source-code: base/init-bare.zeek 4476 4518

   :Type: :zeek:type:`record`


   .. zeek:field:: word_count :zeek:type:`count`

      Count of parameter words
         - 10 for pre NT LM 0.12
         - 12 for NT LM 0.12 with extended security
         - 13 for NT LM 0.12 without extended security


   .. zeek:field:: max_buffer_size :zeek:type:`count`

      Client maximum buffer size


   .. zeek:field:: max_mpx_count :zeek:type:`count`

      Actual maximum multiplexed pending request


   .. zeek:field:: vc_number :zeek:type:`count`

      Virtual circuit number. First VC == 0


   .. zeek:field:: session_key :zeek:type:`count`

      Session key (valid iff vc_number > 0)


   .. zeek:field:: native_os :zeek:type:`string`

      Client's native operating system


   .. zeek:field:: native_lanman :zeek:type:`string`

      Client's native LAN Manager type


   .. zeek:field:: account_name :zeek:type:`string` :zeek:attr:`&optional`

      Account name
      Note: not set for NT LM 0.12 with extended security


   .. zeek:field:: account_password :zeek:type:`string` :zeek:attr:`&optional`

      If challenge/response auth is not being used, this is the password.
      Otherwise, it's the response to the server's challenge.
      Note: Only set for pre NT LM 0.12


   .. zeek:field:: primary_domain :zeek:type:`string` :zeek:attr:`&optional`

      Client's primary domain, if known
      Note: not set for NT LM 0.12 with extended security


   .. zeek:field:: case_insensitive_password :zeek:type:`string` :zeek:attr:`&optional`

      Case insensitive password
      Note: only set for NT LM 0.12 without extended security


   .. zeek:field:: case_sensitive_password :zeek:type:`string` :zeek:attr:`&optional`

      Case sensitive password
      Note: only set for NT LM 0.12 without extended security


   .. zeek:field:: security_blob :zeek:type:`string` :zeek:attr:`&optional`

      Security blob
      Note: only set for NT LM 0.12 with extended security


   .. zeek:field:: capabilities :zeek:type:`SMB1::SessionSetupAndXCapabilities` :zeek:attr:`&optional`

      Client capabilities
      Note: only set for NT LM 0.12



.. zeek:type:: SMB1::SessionSetupAndXResponse
   :source-code: base/init-bare.zeek 4520 4533

   :Type: :zeek:type:`record`


   .. zeek:field:: word_count :zeek:type:`count`

      Count of parameter words (should be 3 for pre NT LM 0.12 and 4 for NT LM 0.12)


   .. zeek:field:: is_guest :zeek:type:`bool` :zeek:attr:`&optional`

      Were we logged in as a guest user?


   .. zeek:field:: native_os :zeek:type:`string` :zeek:attr:`&optional`

      Server's native operating system


   .. zeek:field:: native_lanman :zeek:type:`string` :zeek:attr:`&optional`

      Server's native LAN Manager type


   .. zeek:field:: primary_domain :zeek:type:`string` :zeek:attr:`&optional`

      Server's primary domain


   .. zeek:field:: security_blob :zeek:type:`string` :zeek:attr:`&optional`

      Security blob if NTLM



.. zeek:type:: SMB1::Trans2_Args
   :source-code: base/init-bare.zeek 4535 4560

   :Type: :zeek:type:`record`


   .. zeek:field:: total_param_count :zeek:type:`count`

      Total parameter count


   .. zeek:field:: total_data_count :zeek:type:`count`

      Total data count


   .. zeek:field:: max_param_count :zeek:type:`count`

      Max parameter count


   .. zeek:field:: max_data_count :zeek:type:`count`

      Max data count


   .. zeek:field:: max_setup_count :zeek:type:`count`

      Max setup count


   .. zeek:field:: flags :zeek:type:`count`

      Flags


   .. zeek:field:: trans_timeout :zeek:type:`count`

      Timeout


   .. zeek:field:: param_count :zeek:type:`count`

      Parameter count


   .. zeek:field:: param_offset :zeek:type:`count`

      Parameter offset


   .. zeek:field:: data_count :zeek:type:`count`

      Data count


   .. zeek:field:: data_offset :zeek:type:`count`

      Data offset


   .. zeek:field:: setup_count :zeek:type:`count`

      Setup count



.. zeek:type:: SMB1::Trans2_Sec_Args
   :source-code: base/init-bare.zeek 4581 4600

   :Type: :zeek:type:`record`


   .. zeek:field:: total_param_count :zeek:type:`count`

      Total parameter count


   .. zeek:field:: total_data_count :zeek:type:`count`

      Total data count


   .. zeek:field:: param_count :zeek:type:`count`

      Parameter count


   .. zeek:field:: param_offset :zeek:type:`count`

      Parameter offset


   .. zeek:field:: param_displacement :zeek:type:`count`

      Parameter displacement


   .. zeek:field:: data_count :zeek:type:`count`

      Data count


   .. zeek:field:: data_offset :zeek:type:`count`

      Data offset


   .. zeek:field:: data_displacement :zeek:type:`count`

      Data displacement


   .. zeek:field:: FID :zeek:type:`count`

      File ID



.. zeek:type:: SMB1::Trans_Sec_Args
   :source-code: base/init-bare.zeek 4562 4579

   :Type: :zeek:type:`record`


   .. zeek:field:: total_param_count :zeek:type:`count`

      Total parameter count


   .. zeek:field:: total_data_count :zeek:type:`count`

      Total data count


   .. zeek:field:: param_count :zeek:type:`count`

      Parameter count


   .. zeek:field:: param_offset :zeek:type:`count`

      Parameter offset


   .. zeek:field:: param_displacement :zeek:type:`count`

      Parameter displacement


   .. zeek:field:: data_count :zeek:type:`count`

      Data count


   .. zeek:field:: data_offset :zeek:type:`count`

      Data offset


   .. zeek:field:: data_displacement :zeek:type:`count`

      Data displacement



.. zeek:type:: SMB2::CloseResponse
   :source-code: base/init-bare.zeek 4743 4752

   :Type: :zeek:type:`record`


   .. zeek:field:: alloc_size :zeek:type:`count`

      The size, in bytes of the data that is allocated to the file.


   .. zeek:field:: eof :zeek:type:`count`

      The size, in bytes, of the file.


   .. zeek:field:: times :zeek:type:`SMB::MACTimes`

      The creation, last access, last write, and change times.


   .. zeek:field:: attrs :zeek:type:`SMB2::FileAttrs`

      The attributes of the file.


   The response to an SMB2 *close* request, which is used by the client to close an instance
   of a file that was opened previously.

   For more information, see MS-SMB2:2.2.16

   .. zeek:see:: smb2_close_response

.. zeek:type:: SMB2::CompressionCapabilities
   :source-code: base/init-bare.zeek 4784 4789

   :Type: :zeek:type:`record`


   .. zeek:field:: alg_count :zeek:type:`count`

      The number of algorithms.


   .. zeek:field:: algs :zeek:type:`vector` of :zeek:type:`count`

      An array of compression algorithms.


   Compression information as defined in SMB v. 3.1.1

   For more information, see MS-SMB2:2.3.1.3


.. zeek:type:: SMB2::CreateRequest
   :source-code: base/init-bare.zeek 4891 4898

   :Type: :zeek:type:`record`


   .. zeek:field:: filename :zeek:type:`string`

      Name of the file


   .. zeek:field:: disposition :zeek:type:`count`

      Defines the action the server MUST take if the file that is specified already exists.


   .. zeek:field:: create_options :zeek:type:`count`

      Specifies the options to be applied when creating or opening the file.


   The request sent by the client to request either creation of or access to a file.

   For more information, see MS-SMB2:2.2.13

   .. zeek:see:: smb2_create_request

.. zeek:type:: SMB2::CreateResponse
   :source-code: base/init-bare.zeek 4906 4917

   :Type: :zeek:type:`record`


   .. zeek:field:: file_id :zeek:type:`SMB2::GUID`

      The SMB2 GUID for the file.


   .. zeek:field:: size :zeek:type:`count`

      Size of the file.


   .. zeek:field:: times :zeek:type:`SMB::MACTimes`

      Timestamps associated with the file in question.


   .. zeek:field:: attrs :zeek:type:`SMB2::FileAttrs`

      File attributes.


   .. zeek:field:: create_action :zeek:type:`count`

      The action taken in establishing the open.


   The response to an SMB2 *create_request* request, which is sent by the client to request
   either creation of or access to a file.

   For more information, see MS-SMB2:2.2.14

   .. zeek:see:: smb2_create_response

.. zeek:type:: SMB2::EncryptionCapabilities
   :source-code: base/init-bare.zeek 4773 4778

   :Type: :zeek:type:`record`


   .. zeek:field:: cipher_count :zeek:type:`count`

      The number of ciphers.


   .. zeek:field:: ciphers :zeek:type:`vector` of :zeek:type:`count`

      An array of ciphers.


   Encryption information as defined in SMB v. 3.1.1

   For more information, see MS-SMB2:2.3.1.2


.. zeek:type:: SMB2::FileAttrs
   :source-code: base/init-bare.zeek 4692 4735

   :Type: :zeek:type:`record`


   .. zeek:field:: read_only :zeek:type:`bool`

      The file is read only. Applications can read the file but cannot
      write to it or delete it.


   .. zeek:field:: hidden :zeek:type:`bool`

      The file is hidden. It is not to be included in an ordinary directory listing.


   .. zeek:field:: system :zeek:type:`bool`

      The file is part of or is used exclusively by the operating system.


   .. zeek:field:: directory :zeek:type:`bool`

      The file is a directory.


   .. zeek:field:: archive :zeek:type:`bool`

      The file has not been archived since it was last modified. Applications use
      this attribute to mark files for backup or removal.


   .. zeek:field:: normal :zeek:type:`bool`

      The file has no other attributes set. This attribute is valid only if used alone.


   .. zeek:field:: temporary :zeek:type:`bool`

      The file is temporary. This is a hint to the cache manager that it does not need
      to flush the file to backing storage.


   .. zeek:field:: sparse_file :zeek:type:`bool`

      A file that is a sparse file.


   .. zeek:field:: reparse_point :zeek:type:`bool`

      A file or directory that has an associated reparse point.


   .. zeek:field:: compressed :zeek:type:`bool`

      The file or directory is compressed. For a file, this means that all of the data
      in the file is compressed. For a directory, this means that compression is the
      default for newly created files and subdirectories.


   .. zeek:field:: offline :zeek:type:`bool`

      The data in this file is not available immediately. This attribute indicates that
      the file data is physically moved to offline storage. This attribute is used by
      Remote Storage, which is hierarchical storage management software.


   .. zeek:field:: not_content_indexed :zeek:type:`bool`

      A file or directory that is not indexed by the content indexing service.


   .. zeek:field:: encrypted :zeek:type:`bool`

      A file or directory that is encrypted. For a file, all data streams in the file
      are encrypted. For a directory, encryption is the default for newly created files
      and subdirectories.


   .. zeek:field:: integrity_stream :zeek:type:`bool`

      A file or directory that is configured with integrity support. For a file, all
      data streams in the file have integrity support. For a directory, integrity support
      is the default for newly created files and subdirectories, unless the caller
      specifies otherwise.


   .. zeek:field:: no_scrub_data :zeek:type:`bool`

      A file or directory that is configured to be excluded from the data integrity scan.


   A series of boolean flags describing basic and extended file attributes for SMB2.

   For more information, see MS-CIFS:2.2.1.2.3 and MS-FSCC:2.6

   .. zeek:see:: smb2_create_response

.. zeek:type:: SMB2::FileEA
   :source-code: base/init-bare.zeek 4942 4947

   :Type: :zeek:type:`record`


   .. zeek:field:: ea_name :zeek:type:`string`

      Specifies the extended attribute name


   .. zeek:field:: ea_value :zeek:type:`string`

      Contains the extended attribute value


   This information class is used to query or set extended attribute (EA) information for a file.

   For more information, see MS-SMB2:2.2.39 and MS-FSCC:2.4.15


.. zeek:type:: SMB2::FileEAs
   :source-code: base/init-bare.zeek 4953 4953

   :Type: :zeek:type:`vector` of :zeek:type:`SMB2::FileEA`

   A vector of extended attribute (EA) information for a file.

   For more information, see MS-SMB2:2.2.39 and MS-FSCC:2.4.15


.. zeek:type:: SMB2::Fscontrol
   :source-code: base/init-bare.zeek 4923 4936

   :Type: :zeek:type:`record`


   .. zeek:field:: free_space_start_filtering :zeek:type:`int`

      minimum amount of free disk space required to begin document filtering


   .. zeek:field:: free_space_threshold :zeek:type:`int`

      minimum amount of free disk space required to continue filtering documents and merging word lists


   .. zeek:field:: free_space_stop_filtering :zeek:type:`int`

      minimum amount of free disk space required to continue content filtering


   .. zeek:field:: delete_quota_threshold :zeek:type:`count`

      default per-user disk quota


   .. zeek:field:: default_quota_limit :zeek:type:`count`

      default per-user disk limit


   .. zeek:field:: fs_control_flags :zeek:type:`count`

      file systems control flags passed as unsigned int


   A series of integers flags used to set quota and content indexing control information for a file system volume in SMB2.

   For more information, see MS-SMB2:2.2.39 and MS-FSCC:2.5.2


.. zeek:type:: SMB2::GUID
   :source-code: base/init-bare.zeek 4680 4685

   :Type: :zeek:type:`record`


   .. zeek:field:: persistent :zeek:type:`count`

      A file handle that remains persistent when reconnected after a disconnect


   .. zeek:field:: volatile :zeek:type:`count`

      A file handle that can be changed when reconnected after a disconnect


   An SMB2 globally unique identifier which identifies a file.

   For more information, see MS-SMB2:2.2.14.1

   .. zeek:see:: smb2_close_request smb2_create_response smb2_read_request
      smb2_file_rename smb2_file_delete smb2_write_request

.. zeek:type:: SMB2::Header
   :source-code: base/init-bare.zeek 4647 4672

   :Type: :zeek:type:`record`


   .. zeek:field:: credit_charge :zeek:type:`count`

      The number of credits that this request consumes


   .. zeek:field:: status :zeek:type:`count`

      In a request, this is an indication to the server about the client's channel
      change. In a response, this is the status field


   .. zeek:field:: command :zeek:type:`count`

      The command code of the packet


   .. zeek:field:: credits :zeek:type:`count`

      The number of credits the client is requesting, or the number of credits
      granted to the client in a response.


   .. zeek:field:: flags :zeek:type:`count`

      A flags field, which indicates how to process the operation (e.g. asynchronously)


   .. zeek:field:: message_id :zeek:type:`count`

      A value that uniquely identifies the message request/response pair across all
      messages that are sent on the same transport protocol connection


   .. zeek:field:: process_id :zeek:type:`count`

      A value that uniquely identifies the process that generated the event.


   .. zeek:field:: tree_id :zeek:type:`count`

      A value that uniquely identifies the tree connect for the command.


   .. zeek:field:: session_id :zeek:type:`count`

      A value that uniquely identifies the established session for the command.


   .. zeek:field:: signature :zeek:type:`string`

      The 16-byte signature of the message, if SMB2_FLAGS_SIGNED is set in the ``flags``
      field.


   An SMB2 header.

   For more information, see MS-SMB2:2.2.1.1 and MS-SMB2:2.2.1.2

   .. zeek:see:: smb2_message smb2_close_request smb2_close_response
      smb2_create_request smb2_create_response smb2_negotiate_request
      smb2_negotiate_response smb2_read_request
      smb2_session_setup_request smb2_session_setup_response
      smb2_file_rename smb2_file_delete
      smb2_tree_connect_request smb2_tree_connect_response
      smb2_write_request

.. zeek:type:: SMB2::NegotiateContextValue
   :source-code: base/init-bare.zeek 4795 4808

   :Type: :zeek:type:`record`


   .. zeek:field:: context_type :zeek:type:`count`

      Specifies the type of context (preauth or encryption).


   .. zeek:field:: data_length :zeek:type:`count`

      The length in byte of the data field.


   .. zeek:field:: preauth_info :zeek:type:`SMB2::PreAuthIntegrityCapabilities` :zeek:attr:`&optional`

      The preauthentication information.


   .. zeek:field:: encryption_info :zeek:type:`SMB2::EncryptionCapabilities` :zeek:attr:`&optional`

      The encryption information.


   .. zeek:field:: compression_info :zeek:type:`SMB2::CompressionCapabilities` :zeek:attr:`&optional`

      The compression information.


   .. zeek:field:: netname :zeek:type:`string` :zeek:attr:`&optional`

      Indicates the server name the client must connect to.


   The context type information as defined in SMB v. 3.1.1

   For more information, see MS-SMB2:2.3.1


.. zeek:type:: SMB2::NegotiateContextValues
   :source-code: base/init-bare.zeek 4810 4810

   :Type: :zeek:type:`vector` of :zeek:type:`SMB2::NegotiateContextValue`


.. zeek:type:: SMB2::NegotiateResponse
   :source-code: base/init-bare.zeek 4818 4835

   :Type: :zeek:type:`record`


   .. zeek:field:: dialect_revision :zeek:type:`count`

      The preferred common SMB2 Protocol dialect number from the array that was sent in the SMB2
      NEGOTIATE Request.


   .. zeek:field:: security_mode :zeek:type:`count`

      The security mode field specifies whether SMB signing is enabled, required at the server, or both.


   .. zeek:field:: server_guid :zeek:type:`SMB2::GUID`

      A globally unique identifier that is generate by the server to uniquely identify the server.


   .. zeek:field:: system_time :zeek:type:`time`

      The system time of the SMB2 server when the SMB2 NEGOTIATE Request was processed.


   .. zeek:field:: server_start_time :zeek:type:`time`

      The SMB2 server start time.


   .. zeek:field:: negotiate_context_count :zeek:type:`count`

      The number of negotiate context values in SMB v. 3.1.1, otherwise reserved to 0.


   .. zeek:field:: negotiate_context_values :zeek:type:`SMB2::NegotiateContextValues`

      An array of context values in SMB v. 3.1.1.


   The response to an SMB2 *negotiate* request, which is used by the client to notify the server
   what dialects of the SMB2 protocol the client understands.

   For more information, see MS-SMB2:2.2.4

   .. zeek:see:: smb2_negotiate_response

.. zeek:type:: SMB2::PreAuthIntegrityCapabilities
   :source-code: base/init-bare.zeek 4758 4767

   :Type: :zeek:type:`record`


   .. zeek:field:: hash_alg_count :zeek:type:`count`

      The number of hash algorithms.


   .. zeek:field:: salt_length :zeek:type:`count`

      The salt length.


   .. zeek:field:: hash_alg :zeek:type:`vector` of :zeek:type:`count`

      An array of hash algorithms (counts).


   .. zeek:field:: salt :zeek:type:`string`

      The salt.


   Preauthentication information as defined in SMB v. 3.1.1

   For more information, see MS-SMB2:2.3.1.1


.. zeek:type:: SMB2::SessionSetupFlags
   :source-code: base/init-bare.zeek 4854 4861

   :Type: :zeek:type:`record`


   .. zeek:field:: guest :zeek:type:`bool`

      If set, the client has been authenticated as a guest user.


   .. zeek:field:: anonymous :zeek:type:`bool`

      If set, the client has been authenticated as an anonymous user.


   .. zeek:field:: encrypt :zeek:type:`bool`

      If set, the server requires encryption of messages on this session.


   A flags field that indicates additional information about the session that's sent in the
   *session_setup* response.

   For more information, see MS-SMB2:2.2.6

   .. zeek:see:: smb2_session_setup_response

.. zeek:type:: SMB2::SessionSetupRequest
   :source-code: base/init-bare.zeek 4843 4846

   :Type: :zeek:type:`record`


   .. zeek:field:: security_mode :zeek:type:`count`

      The security mode field specifies whether SMB signing is enabled or required at the client.


   The request sent by the client to request a new authenticated session
   within a new or existing SMB 2 Protocol transport connection to the server.

   For more information, see MS-SMB2:2.2.5

   .. zeek:see:: smb2_session_setup_request

.. zeek:type:: SMB2::SessionSetupResponse
   :source-code: base/init-bare.zeek 4870 4873

   :Type: :zeek:type:`record`


   .. zeek:field:: flags :zeek:type:`SMB2::SessionSetupFlags`

      Additional information about the session


   The response to an SMB2 *session_setup* request, which is sent by the client to request a
   new authenticated session within a new or existing SMB 2 Protocol transport connection
   to the server.

   For more information, see MS-SMB2:2.2.6

   .. zeek:see:: smb2_session_setup_response

.. zeek:type:: SMB2::Transform_header
   :source-code: base/init-bare.zeek 4966 4977

   :Type: :zeek:type:`record`


   .. zeek:field:: signature :zeek:type:`string`

      The 16-byte signature of the encrypted message, generated by using Session.EncryptionKey.


   .. zeek:field:: nonce :zeek:type:`string`

      An implementation specific value assigned for every encrypted message.


   .. zeek:field:: orig_msg_size :zeek:type:`count`

      The size, in bytes, of the SMB2 message.


   .. zeek:field:: flags :zeek:type:`count`

      A flags field, interpreted in different ways depending of the SMB2 dialect.


   .. zeek:field:: session_id :zeek:type:`count`

      A value that uniquely identifies the established session for the command.


   An SMB2 transform header (for SMB 3.x dialects with encryption enabled).

   For more information, see MS-SMB2:2.2.41

   .. zeek:see:: smb2_transform_header smb2_message smb2_close_request smb2_close_response
      smb2_create_request smb2_create_response smb2_negotiate_request
      smb2_negotiate_response smb2_read_request
      smb2_session_setup_request smb2_session_setup_response
      smb2_file_rename smb2_file_delete
      smb2_tree_connect_request smb2_tree_connect_response
      smb2_write_request

.. zeek:type:: SMB2::TreeConnectResponse
   :source-code: base/init-bare.zeek 4881 4884

   :Type: :zeek:type:`record`


   .. zeek:field:: share_type :zeek:type:`count`

      The type of share being accessed. Physical disk, named pipe, or printer.


   The response to an SMB2 *tree_connect* request, which is sent by the client to request
   access to a particular share on the server.

   For more information, see MS-SMB2:2.2.9

   .. zeek:see:: smb2_tree_connect_response

.. zeek:type:: SMB::MACTimes
   :source-code: base/init-bare.zeek 4230 4247

   :Type: :zeek:type:`record`


   .. zeek:field:: modified :zeek:type:`time` :zeek:attr:`&log`

      The time when data was last written to the file.


   .. zeek:field:: modified_raw :zeek:type:`count`

      Same as `modified` but in SMB's original `FILETIME` integer format.


   .. zeek:field:: accessed :zeek:type:`time` :zeek:attr:`&log`

      The time when the file was last accessed.


   .. zeek:field:: accessed_raw :zeek:type:`count`

      Same as `accessed` but in SMB's original `FILETIME` integer format.


   .. zeek:field:: created :zeek:type:`time` :zeek:attr:`&log`

      The time the file was created.


   .. zeek:field:: created_raw :zeek:type:`count`

      Same as `created` but in SMB's original `FILETIME` integer format.


   .. zeek:field:: changed :zeek:type:`time` :zeek:attr:`&log`

      The time when the file was last modified.


   .. zeek:field:: changed_raw :zeek:type:`count`

      Same as `changed` but in SMB's original `FILETIME` integer format.


   MAC times for a file.

   For more information, see MS-SMB2:2.2.16

   .. zeek:see:: smb1_nt_create_andx_response smb2_create_response

.. zeek:type:: SNMP::Binding
   :source-code: base/init-bare.zeek 5619 5622

   :Type: :zeek:type:`record`


   .. zeek:field:: oid :zeek:type:`string`


   .. zeek:field:: value :zeek:type:`SNMP::ObjectValue`


   The ``VarBind`` data structure from either :rfc:`1157` or
   :rfc:`3416`, which maps an Object Identifier to a value.

.. zeek:type:: SNMP::Bindings
   :source-code: base/init-bare.zeek 5626 5626

   :Type: :zeek:type:`vector` of :zeek:type:`SNMP::Binding`

   A ``VarBindList`` data structure from either :rfc:`1157` or :rfc:`3416`.
   A sequences of :zeek:see:`SNMP::Binding`, which maps an OIDs to values.

.. zeek:type:: SNMP::BulkPDU
   :source-code: base/init-bare.zeek 5647 5652

   :Type: :zeek:type:`record`


   .. zeek:field:: request_id :zeek:type:`int`


   .. zeek:field:: non_repeaters :zeek:type:`count`


   .. zeek:field:: max_repetitions :zeek:type:`count`


   .. zeek:field:: bindings :zeek:type:`SNMP::Bindings`


   A ``BulkPDU`` data structure from :rfc:`3416`.

.. zeek:type:: SNMP::Header
   :source-code: base/init-bare.zeek 5574 5579

   :Type: :zeek:type:`record`


   .. zeek:field:: version :zeek:type:`count`


   .. zeek:field:: v1 :zeek:type:`SNMP::HeaderV1` :zeek:attr:`&optional`

      Set when ``version`` is 0.


   .. zeek:field:: v2 :zeek:type:`SNMP::HeaderV2` :zeek:attr:`&optional`

      Set when ``version`` is 1.


   .. zeek:field:: v3 :zeek:type:`SNMP::HeaderV3` :zeek:attr:`&optional`

      Set when ``version`` is 3.


   A generic SNMP header data structure that may include data from
   any version of SNMP.  The value of the ``version`` field
   determines what header field is initialized.

.. zeek:type:: SNMP::HeaderV1
   :source-code: base/init-bare.zeek 5520 5522

   :Type: :zeek:type:`record`


   .. zeek:field:: community :zeek:type:`string`


   The top-level message data structure of an SNMPv1 datagram, not
   including the PDU data.  See :rfc:`1157`.

.. zeek:type:: SNMP::HeaderV2
   :source-code: base/init-bare.zeek 5526 5528

   :Type: :zeek:type:`record`


   .. zeek:field:: community :zeek:type:`string`


   The top-level message data structure of an SNMPv2 datagram, not
   including the PDU data.  See :rfc:`1901`.

.. zeek:type:: SNMP::HeaderV3
   :source-code: base/init-bare.zeek 5558 5569

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`count`


   .. zeek:field:: max_size :zeek:type:`count`


   .. zeek:field:: flags :zeek:type:`count`


   .. zeek:field:: auth_flag :zeek:type:`bool`


   .. zeek:field:: priv_flag :zeek:type:`bool`


   .. zeek:field:: reportable_flag :zeek:type:`bool`


   .. zeek:field:: security_model :zeek:type:`count`


   .. zeek:field:: security_params :zeek:type:`string`


   .. zeek:field:: pdu_context :zeek:type:`SNMP::ScopedPDU_Context` :zeek:attr:`&optional`


   .. zeek:field:: user_security_parameters :zeek:type:`SNMP::UserSecurityParameters` :zeek:attr:`&optional`


   The top-level message data structure of an SNMPv3 datagram, not
   including the PDU data.  See :rfc:`3412`.

.. zeek:type:: SNMP::ObjectValue
   :source-code: base/init-bare.zeek 5590 5597

   :Type: :zeek:type:`record`


   .. zeek:field:: tag :zeek:type:`count`


   .. zeek:field:: oid :zeek:type:`string` :zeek:attr:`&optional`


   .. zeek:field:: signed :zeek:type:`int` :zeek:attr:`&optional`


   .. zeek:field:: unsigned :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: address :zeek:type:`addr` :zeek:attr:`&optional`


   .. zeek:field:: octets :zeek:type:`string` :zeek:attr:`&optional`


   A generic SNMP object value, that may include any of the
   valid ``ObjectSyntax`` values from :rfc:`1155` or :rfc:`3416`.
   The value is decoded whenever possible and assigned to
   the appropriate field, which can be determined from the value
   of the ``tag`` field.  For tags that can't be mapped to an
   appropriate type, the ``octets`` field holds the BER encoded
   ASN.1 content if there is any (though, ``octets`` is may also
   be used for other tags such as OCTET STRINGS or Opaque).  Null
   values will only have their corresponding tag value set.

.. zeek:type:: SNMP::PDU
   :source-code: base/init-bare.zeek 5629 5634

   :Type: :zeek:type:`record`


   .. zeek:field:: request_id :zeek:type:`int`


   .. zeek:field:: error_status :zeek:type:`int`


   .. zeek:field:: error_index :zeek:type:`int`


   .. zeek:field:: bindings :zeek:type:`SNMP::Bindings`


   A ``PDU`` data structure from either :rfc:`1157` or :rfc:`3416`.

.. zeek:type:: SNMP::ScopedPDU_Context
   :source-code: base/init-bare.zeek 5533 5536

   :Type: :zeek:type:`record`


   .. zeek:field:: engine_id :zeek:type:`string`


   .. zeek:field:: name :zeek:type:`string`


   The ``ScopedPduData`` data structure of an SNMPv3 datagram, not
   including the PDU data (i.e. just the "context" fields).
   See :rfc:`3412`.

.. zeek:type:: SNMP::TrapPDU
   :source-code: base/init-bare.zeek 5637 5644

   :Type: :zeek:type:`record`


   .. zeek:field:: enterprise :zeek:type:`string`


   .. zeek:field:: agent :zeek:type:`addr`


   .. zeek:field:: generic_trap :zeek:type:`int`


   .. zeek:field:: specific_trap :zeek:type:`int`


   .. zeek:field:: time_stamp :zeek:type:`count`


   .. zeek:field:: bindings :zeek:type:`SNMP::Bindings`


   A ``Trap-PDU`` data structure from :rfc:`1157`.

.. zeek:type:: SNMP::UserSecurityParameters
   :source-code: base/init-bare.zeek 5541 5554

   :Type: :zeek:type:`record`


   .. zeek:field:: AuthoritativeEngineID :zeek:type:`string`

      snmpEngineID of the authoritative SNMP engine.


   .. zeek:field:: AuthoritativeEngineBoots :zeek:type:`int`

      snmpEngineBoots value of the authoritative SNMP engine.


   .. zeek:field:: AuthoritativeEngineTime :zeek:type:`int`

      snmpEngineTime value of the authoritative SNMP engine


   .. zeek:field:: UserName :zeek:type:`string`

      User on the behalf of which the message is exchanged.


   .. zeek:field:: AuthenticationParameters :zeek:type:`string`

      raw msgAuthenticationParameters.


   .. zeek:field:: PrivacyParameters :zeek:type:`string`

      raw msgPrivacyParameters.


   The UserSecurityParaneters for SNMPv3 messages using the
   User-based Security Model. See :rfc:`3414`.
   Experimental: the format of this record can change till Zeek 9.

.. zeek:type:: SOCKS::Address
   :source-code: base/init-bare.zeek 5376 5379

   :Type: :zeek:type:`record`


   .. zeek:field:: host :zeek:type:`addr` :zeek:attr:`&optional` :zeek:attr:`&log`


   .. zeek:field:: name :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

   :Attributes: :zeek:attr:`&log`

   This record is for a SOCKS client or server to provide either a
   name or an address to represent a desired or established connection.

.. zeek:type:: SSH::Algorithm_Prefs
   :source-code: base/init-bare.zeek 3985 3990

   :Type: :zeek:type:`record`


   .. zeek:field:: client_to_server :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      The algorithm preferences for client to server communication


   .. zeek:field:: server_to_client :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      The algorithm preferences for server to client communication


   The client and server each have some preferences for the algorithms used
   in each direction.

.. zeek:type:: SSH::Capabilities
   :source-code: base/init-bare.zeek 3997 4012

   :Type: :zeek:type:`record`


   .. zeek:field:: kex_algorithms :zeek:type:`string_vec`

      Key exchange algorithms


   .. zeek:field:: server_host_key_algorithms :zeek:type:`string_vec`

      The algorithms supported for the server host key


   .. zeek:field:: encryption_algorithms :zeek:type:`SSH::Algorithm_Prefs`

      Symmetric encryption algorithm preferences


   .. zeek:field:: mac_algorithms :zeek:type:`SSH::Algorithm_Prefs`

      Symmetric MAC algorithm preferences


   .. zeek:field:: compression_algorithms :zeek:type:`SSH::Algorithm_Prefs`

      Compression algorithm preferences


   .. zeek:field:: languages :zeek:type:`SSH::Algorithm_Prefs` :zeek:attr:`&optional`

      Language preferences


   .. zeek:field:: is_server :zeek:type:`bool`

      Are these the capabilities of the server?


   This record lists the preferences of an SSH endpoint for
   algorithm selection. During the initial :abbr:`SSH (Secure Shell)`
   key exchange, each endpoint lists the algorithms
   that it supports, in order of preference. See
   :rfc:`4253#section-7.1` for details.

.. zeek:type:: SSL::PSKIdentity
   :source-code: base/init-bare.zeek 5288 5291

   :Type: :zeek:type:`record`


   .. zeek:field:: identity :zeek:type:`string`

      PSK identity


   .. zeek:field:: obfuscated_ticket_age :zeek:type:`count`



.. zeek:type:: SSL::SignatureAndHashAlgorithm
   :source-code: base/init-bare.zeek 5283 5286

   :Type: :zeek:type:`record`


   .. zeek:field:: HashAlgorithm :zeek:type:`count`

      Hash algorithm number


   .. zeek:field:: SignatureAlgorithm :zeek:type:`count`

      Signature algorithm number



.. zeek:type:: SYN_packet
   :source-code: base/init-bare.zeek 1159 1170

   :Type: :zeek:type:`record`


   .. zeek:field:: is_orig :zeek:type:`bool`

      True if the packet was sent the connection's originator.


   .. zeek:field:: DF :zeek:type:`bool`

      True if the *don't fragment* is set in the IP header.


   .. zeek:field:: ttl :zeek:type:`count`

      The IP header's time-to-live.


   .. zeek:field:: size :zeek:type:`count`

      The size of the packet's payload as specified in the IP header.


   .. zeek:field:: win_size :zeek:type:`count`

      The window size from the TCP header.


   .. zeek:field:: win_scale :zeek:type:`int`

      The window scale option if present, or -1 if not.


   .. zeek:field:: MSS :zeek:type:`count`

      The maximum segment size if present, or 0 if not.


   .. zeek:field:: SACK_OK :zeek:type:`bool`

      True if the *SACK* option (Selective ACKnowledgement) is present.


   .. zeek:field:: TSval :zeek:type:`count` :zeek:attr:`&optional`

      The TCP TS value if present.


   .. zeek:field:: TSecr :zeek:type:`count` :zeek:attr:`&optional`

      The TCP TS echo reply if present.


   Fields of a SYN packet.

   .. zeek:see:: connection_SYN_packet

.. zeek:type:: Storage::OperationResult
   :source-code: base/init-bare.zeek 6820 6831

   :Type: :zeek:type:`record`


   .. zeek:field:: code :zeek:type:`Storage::ReturnCode`

      One of a set of backend-redefinable return codes.


   .. zeek:field:: error_str :zeek:type:`string` :zeek:attr:`&optional`

      An optional error string. This should be set when the
      ``code`` field is not set to ``SUCCESS``.


   .. zeek:field:: value :zeek:type:`any` :zeek:attr:`&optional`

      An optional value for operations that can return data. ``get``
      operations uses this to return the value when a match was found
      for the key requested. ``open_backend`` uses this to return the
      backend handle on successful connections.


   Returned as the result of the various storage operations.

.. zeek:type:: Storage::ReturnCode
   :source-code: base/init-bare.zeek 6786 6818

   :Type: :zeek:type:`enum`

      .. zeek:enum:: Storage::SUCCESS Storage::ReturnCode

         Operation succeeded.

      .. zeek:enum:: Storage::VAL_TYPE_MISMATCH Storage::ReturnCode

         Type of value passed to operation does not match type of
         value passed when opening backend.

      .. zeek:enum:: Storage::KEY_TYPE_MISMATCH Storage::ReturnCode

         Type of key passed to operation does not match type of
         key passed when opening backend.

      .. zeek:enum:: Storage::NOT_CONNECTED Storage::ReturnCode

         Backend is not connected.

      .. zeek:enum:: Storage::TIMEOUT Storage::ReturnCode

         Operation timed out.

      .. zeek:enum:: Storage::CONNECTION_LOST Storage::ReturnCode

         Connection to backed was lost unexpectedly.

      .. zeek:enum:: Storage::OPERATION_FAILED Storage::ReturnCode

         Generic operation failure.

      .. zeek:enum:: Storage::KEY_NOT_FOUND Storage::ReturnCode

         Key requested was not found in backend.

      .. zeek:enum:: Storage::KEY_EXISTS Storage::ReturnCode

         Key requested for overwrite already exists.

      .. zeek:enum:: Storage::CONNECTION_FAILED Storage::ReturnCode

         Generic connection-setup failure. This is not if the connection
         was lost, but if it failed to be setup in the first place.

      .. zeek:enum:: Storage::DISCONNECTION_FAILED Storage::ReturnCode

         Generic disconnection failure.

      .. zeek:enum:: Storage::INITIALIZATION_FAILED Storage::ReturnCode

         Generic initialization failure.

      .. zeek:enum:: Storage::IN_PROGRESS Storage::ReturnCode

         Returned from async operations when the backend is waiting
         for a result.
   :Attributes: :zeek:attr:`&redef`

   Common set of statuses that can be returned by storage operations. Backend plugins
   can add to this enum if custom values are needed.

.. zeek:type:: TCP::Option
   :source-code: base/init-bare.zeek 714 741

   :Type: :zeek:type:`record`


   .. zeek:field:: kind :zeek:type:`count`

      The kind number associated with the option.  Other optional fields
      of this record may be set depending on this value.


   .. zeek:field:: length :zeek:type:`count`

      The total length of the option in bytes, including the kind byte and
      length byte (if present).


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      This field is set to the raw option bytes if the kind is not
      otherwise known/parsed.  It's also set for known kinds whose length
      was invalid.


   .. zeek:field:: mss :zeek:type:`count` :zeek:attr:`&optional`

      Kind 2: Maximum Segment Size.


   .. zeek:field:: window_scale :zeek:type:`count` :zeek:attr:`&optional`

      Kind 3: Window scale.


   .. zeek:field:: sack :zeek:type:`index_vec` :zeek:attr:`&optional`

      Kind 5: Selective ACKnowledgement (SACK).  This is a list of 2, 4,
      6, or 8 numbers with each consecutive pair being a 32-bit
      begin-pointer and 32-bit end pointer.


   .. zeek:field:: send_timestamp :zeek:type:`count` :zeek:attr:`&optional`

      Kind 8: 4-byte sender timestamp value.


   .. zeek:field:: echo_timestamp :zeek:type:`count` :zeek:attr:`&optional`

      Kind 8: 4-byte echo reply timestamp value.


   .. zeek:field:: rate :zeek:type:`count` :zeek:attr:`&optional`

      Kind 27: TCP Quick Start Response value.


   .. zeek:field:: ttl_diff :zeek:type:`count` :zeek:attr:`&optional`


   .. zeek:field:: qs_nonce :zeek:type:`count` :zeek:attr:`&optional`


   A TCP Option field parsed from a TCP header.

.. zeek:type:: TCP::OptionList
   :source-code: base/init-bare.zeek 744 744

   :Type: :zeek:type:`vector` of :zeek:type:`TCP::Option`

   The full list of TCP Option fields parsed from a TCP header.

.. zeek:type:: TCP::RawOption
   :source-code: base/init-bare.zeek 747 752

   :Type: :zeek:type:`record`


   .. zeek:field:: kind :zeek:type:`count`

      Number identifying the option


   .. zeek:field:: data :zeek:type:`string`

      Raw, unparsed data of the option


   A Raw TCP Option field from a TCP header

.. zeek:type:: TCP::RawOptionList
   :source-code: base/init-bare.zeek 755 755

   :Type: :zeek:type:`vector` of :zeek:type:`TCP::RawOption`

   The full list of TCP option fields in a TCP header.

.. zeek:type:: Telemetry::HistogramMetric
   :source-code: base/init-bare.zeek 6567 6591

   :Type: :zeek:type:`record`


   .. zeek:field:: opts :zeek:type:`Telemetry::MetricOpts`

      A :zeek:see:`Telemetry::MetricOpts` record describing this histogram.


   .. zeek:field:: label_names :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&default` = ``[]`` :zeek:attr:`&optional`

      The label names (also called dimensions) of the metric. When
      instantiating or working with concrete metrics, corresponding
      label values have to be provided. Examples of a label might
      be the protocol a general observation applies to, the
      directionality in a traffic flow, or protocol-specific
      context like a particular message type.


   .. zeek:field:: label_values :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      The label values associated with this metric, if any.


   .. zeek:field:: values :zeek:type:`vector` of :zeek:type:`double`

      Individual counters for each of the buckets as
      described by the *bounds* field in *opts*;


   .. zeek:field:: observations :zeek:type:`double`

      The number of observations made for this histogram.


   .. zeek:field:: sum :zeek:type:`double`

      The sum of all observations for this histogram.


   Histograms returned by the :zeek:see:`Telemetry::collect_histogram_metrics` function.

.. zeek:type:: Telemetry::HistogramMetricVector
   :source-code: base/init-bare.zeek 6609 6609

   :Type: :zeek:type:`vector` of :zeek:type:`Telemetry::HistogramMetric`


.. zeek:type:: Telemetry::Metric
   :source-code: base/init-bare.zeek 6544 6564

   :Type: :zeek:type:`record`


   .. zeek:field:: opts :zeek:type:`Telemetry::MetricOpts`

      A :zeek:see:`Telemetry::MetricOpts` record describing this metric.


   .. zeek:field:: label_names :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&default` = ``[]`` :zeek:attr:`&optional`

      The label names (also called dimensions) of the metric. When
      instantiating or working with concrete metrics, corresponding
      label values have to be provided. Examples of a label might
      be the protocol a general observation applies to, the
      directionality in a traffic flow, or protocol-specific
      context like a particular message type.


   .. zeek:field:: label_values :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      The label values associated with this metric, if any.


   .. zeek:field:: value :zeek:type:`double` :zeek:attr:`&optional`

      The value of gauge or counter cast to a double
      independent of the underlying data type.
      This value is set for all counter and gauge metrics,
      it is unset for histograms.


   Metrics returned by the :zeek:see:`Telemetry::collect_metrics` function.

.. zeek:type:: Telemetry::MetricOpts
   :source-code: base/init-bare.zeek 6493 6541

   :Type: :zeek:type:`record`


   .. zeek:field:: prefix :zeek:type:`string`

      The prefix (namespace) of the metric. Zeek uses the ``zeek``
      prefix for any internal metrics and the ``process`` prefix
      for any metrics involving process state (CPU, memory, etc).


   .. zeek:field:: name :zeek:type:`string`

      The human-readable name of the metric. This is set to the
      full prefixed name including the unit when returned from
      :zeek:see:`Telemetry::collect_metrics` or
      :zeek:see:`Telemetry::collect_histogram_metrics`.


   .. zeek:field:: unit :zeek:type:`string` :zeek:attr:`&optional`

      The unit of the metric. Leave this unset for a unit-less
      metric. Will be unset when returned from
      :zeek:see:`Telemetry::collect_metrics` or
      :zeek:see:`Telemetry::collect_histogram_metrics`.


   .. zeek:field:: help_text :zeek:type:`string` :zeek:attr:`&optional`

      Documentation for this metric.


   .. zeek:field:: label_names :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&default` = ``[]`` :zeek:attr:`&optional`

      The label names (also called dimensions) of the metric. When
      instantiating or working with concrete metrics, corresponding
      label values have to be provided. Examples of a label might
      be the protocol a general observation applies to, the
      directionality in a traffic flow, or protocol-specific
      context like a particular message type. This field is only
      used in the construction of new metrics and will not be
      filled in when returned from
      :zeek:see:`Telemetry::collect_metrics` or
      :zeek:see:`Telemetry::collect_histogram_metrics`,


   .. zeek:field:: is_total :zeek:type:`bool` :zeek:attr:`&optional`

      Whether the metric represents something that is accumulating.
      Defaults to ``T`` for counters and ``F`` for gauges and
      histograms.


   .. zeek:field:: bounds :zeek:type:`vector` of :zeek:type:`double` :zeek:attr:`&optional`

      When creating a :zeek:see:`Telemetry::HistogramFamily`,
      describes the number and bounds of the individual buckets.


   .. zeek:field:: metric_type :zeek:type:`Telemetry::MetricType` :zeek:attr:`&optional`

      Describes the underlying metric type.
      Only set in the return value of
      :zeek:see:`Telemetry::collect_metrics` or
      :zeek:see:`Telemetry::collect_histogram_metrics`,
      otherwise ignored.


   Type that captures options used to create metrics.

.. zeek:type:: Telemetry::MetricVector
   :source-code: base/init-bare.zeek 6608 6608

   :Type: :zeek:type:`vector` of :zeek:type:`Telemetry::Metric`


.. zeek:type:: ThreadStats
   :source-code: base/init-bare.zeek 1309 1311

   :Type: :zeek:type:`record`


   .. zeek:field:: num_threads :zeek:type:`count`


   Statistics about threads.

   .. zeek:see:: get_thread_stats

.. zeek:type:: TimerStats
   :source-code: base/init-bare.zeek 1265 1269

   :Type: :zeek:type:`record`


   .. zeek:field:: current :zeek:type:`count`

      Current number of pending timers.


   .. zeek:field:: max :zeek:type:`count`

      Maximum number of concurrent timers pending so far.


   .. zeek:field:: cumulative :zeek:type:`count`

      Cumulative number of timers scheduled.


   Statistics of timers.

   .. zeek:see:: get_timer_stats

.. zeek:type:: Tunnel::EncapsulatingConn
   :source-code: base/init-bare.zeek 762 774

   :Type: :zeek:type:`record`


   .. zeek:field:: cid :zeek:type:`conn_id` :zeek:attr:`&log`

      The 4-tuple of the encapsulating "connection". In case of an
      IP-in-IP tunnel the ports will be set to 0. The direction
      (i.e., orig and resp) are set according to the first tunneled
      packet seen and not according to the side that established
      the tunnel.


   .. zeek:field:: tunnel_type :zeek:type:`Tunnel::Type` :zeek:attr:`&log`

      The type of tunnel.


   .. zeek:field:: uid :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      A globally unique identifier that, for non-IP-in-IP tunnels,
      cross-references the *uid* field of :zeek:type:`connection`.

   :Attributes: :zeek:attr:`&log`

   Records the identity of an encapsulating parent of a tunneled connection.

.. zeek:type:: WebSocket::AnalyzerConfig
   :source-code: base/init-bare.zeek 853 869

   :Type: :zeek:type:`record`


   .. zeek:field:: analyzer :zeek:type:`Analyzer::Tag` :zeek:attr:`&optional`

      The analyzer to attach for analysis of the WebSocket
      frame payload. See *use_dpd* below for the behavior
      when unset.


   .. zeek:field:: use_dpd :zeek:type:`bool` :zeek:attr:`&default` = :zeek:see:`WebSocket::use_dpd_default` :zeek:attr:`&optional`

      If *analyzer* is unset, determines whether to attach a
      PIA_TCP analyzer for dynamic protocol detection with
      WebSocket payload.


   .. zeek:field:: subprotocol :zeek:type:`string` :zeek:attr:`&optional`

      The subprotocol as selected by the server, if any.


   .. zeek:field:: server_extensions :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      The WebSocket extensions as selected by the server, if any.


   Record type that is passed to :zeek:see:`WebSocket::configure_analyzer`.

   This record allows to configure the WebSocket analyzer given
   parameters collected from HTTP headers.

.. zeek:type:: X509::BasicConstraints
   :source-code: base/init-bare.zeek 5347 5350

   :Type: :zeek:type:`record`


   .. zeek:field:: ca :zeek:type:`bool` :zeek:attr:`&log`

      CA flag set?


   .. zeek:field:: path_len :zeek:type:`count` :zeek:attr:`&optional` :zeek:attr:`&log`

      Maximum path length

   :Attributes: :zeek:attr:`&log`


.. zeek:type:: X509::Certificate
   :source-code: base/init-bare.zeek 5322 5337

   :Type: :zeek:type:`record`


   .. zeek:field:: version :zeek:type:`count` :zeek:attr:`&log`

      Version number.


   .. zeek:field:: serial :zeek:type:`string` :zeek:attr:`&log`

      Serial number.


   .. zeek:field:: subject :zeek:type:`string` :zeek:attr:`&log`

      Subject.


   .. zeek:field:: issuer :zeek:type:`string` :zeek:attr:`&log`

      Issuer.


   .. zeek:field:: cn :zeek:type:`string` :zeek:attr:`&optional`

      Last (most specific) common name.


   .. zeek:field:: not_valid_before :zeek:type:`time` :zeek:attr:`&log`

      Timestamp before when certificate is not valid.


   .. zeek:field:: not_valid_after :zeek:type:`time` :zeek:attr:`&log`

      Timestamp after when certificate is not valid.


   .. zeek:field:: key_alg :zeek:type:`string` :zeek:attr:`&log`

      Name of the key algorithm


   .. zeek:field:: sig_alg :zeek:type:`string` :zeek:attr:`&log`

      Name of the signature algorithm


   .. zeek:field:: key_type :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      Key type, if key parseable by openssl (either rsa, dsa or ec)


   .. zeek:field:: key_length :zeek:type:`count` :zeek:attr:`&optional` :zeek:attr:`&log`

      Key length in bits


   .. zeek:field:: exponent :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      Exponent, if RSA-certificate


   .. zeek:field:: curve :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      Curve, if EC-certificate


   .. zeek:field:: tbs_sig_alg :zeek:type:`string`

      Name of the signature algorithm given inside the tbsCertificate. Should be equivalent to `sig_alg`.



.. zeek:type:: X509::Extension
   :source-code: base/init-bare.zeek 5339 5345

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      Long name of extension. oid if name not known


   .. zeek:field:: short_name :zeek:type:`string` :zeek:attr:`&optional`

      Short name of extension if known


   .. zeek:field:: oid :zeek:type:`string`

      Oid of extension


   .. zeek:field:: critical :zeek:type:`bool`

      True if extension is critical


   .. zeek:field:: value :zeek:type:`string`

      Extension content parsed to string for known extensions. Raw data otherwise.



.. zeek:type:: X509::Result
   :source-code: base/init-bare.zeek 5361 5368

   :Type: :zeek:type:`record`


   .. zeek:field:: result :zeek:type:`int`

      OpenSSL result code


   .. zeek:field:: result_string :zeek:type:`string`

      Result as string


   .. zeek:field:: chain_certs :zeek:type:`vector` of :zeek:type:`opaque` of x509 :zeek:attr:`&optional`

      References to the final certificate chain, if verification successful. End-host certificate is first.


   Result of an X509 certificate chain verification

.. zeek:type:: X509::SubjectAlternativeName
   :source-code: base/init-bare.zeek 5352 5358

   :Type: :zeek:type:`record`


   .. zeek:field:: dns :zeek:type:`string_vec` :zeek:attr:`&optional` :zeek:attr:`&log`

      List of DNS entries in SAN


   .. zeek:field:: uri :zeek:type:`string_vec` :zeek:attr:`&optional` :zeek:attr:`&log`

      List of URI entries in SAN


   .. zeek:field:: email :zeek:type:`string_vec` :zeek:attr:`&optional` :zeek:attr:`&log`

      List of email entries in SAN


   .. zeek:field:: ip :zeek:type:`addr_vec` :zeek:attr:`&optional` :zeek:attr:`&log`

      List of IP entries in SAN


   .. zeek:field:: other_fields :zeek:type:`bool`

      True if the certificate contained other, not recognized or parsed name fields



.. zeek:type:: ZAM::Prof::Profile
   :source-code: base/init-bare.zeek 6850 6879

   :Type: :zeek:type:`record`


   .. zeek:field:: num_bodies :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      How many compiled ZAM bodies are associated with the module.
      A value of 0 indicates either the module doesn't exist or ZAM
      itself was not activated.


   .. zeek:field:: num_calls :zeek:type:`count` :zeek:attr:`&optional`

      Number of calls so far to ZAM bodies in the module.


   .. zeek:field:: num_inst :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      How many ZAM instructions have executed so far on behalf of
      the module.


   .. zeek:field:: CPU :zeek:type:`interval` :zeek:attr:`&optional`

      The following two will only be present if a previous call to
      set_module_profiling() set CPU/memory profiling for the module.
      Estimated total (user) CPU time so far. Some ZAM bodies include
      code for multiple modules. For those, the contribution to the
      estimate is based on the ratio of the number of instructions
      associated with the module executed vs. total number of
      instructions executed for the given shared body. Note: you can
      adjust (somewhat) for bias in the measurements by subtracting
      "ZAM::Prof::estimated_profiling_overhead() * $num_calls".


   .. zeek:field:: mem :zeek:type:`count` :zeek:attr:`&optional`

      Estimate of total memory used to date, in bytes. The number is
      only a rough estimate, and uses the same ratio for bodies shared
      across multiple modules as for CPU.


   Summarizes ZAM profiling information for a given module.

.. zeek:type:: addr_set
   :source-code: base/init-bare.zeek 40 40

   :Type: :zeek:type:`set` [:zeek:type:`addr`]

   A set of addresses.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: addr_vec
   :source-code: base/init-bare.zeek 104 104

   :Type: :zeek:type:`vector` of :zeek:type:`addr`

   A vector of addresses.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: any_vec
   :source-code: base/init-bare.zeek 83 83

   :Type: :zeek:type:`vector` of :zeek:type:`any`

   A vector of any, used by some builtin functions to store a list of varying
   types.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: assertion_failure
   :source-code: base/init-bare.zeek 1489 1489

   :Type: :zeek:type:`hook` (cond: :zeek:type:`string`, msg: :zeek:type:`string`, bt: :zeek:type:`Backtrace`) : :zeek:type:`bool`

   A hook that is invoked when an assert statement fails.

   By default, a reporter error message is logged describing the failing
   assert similarly to how scripting errors are reported after invoking
   this hook. Using the :zeek:see:`break` statement in an assertion_failure
   hook handler allows to suppress this message.


   :param cond: The string representation of the condition.


   :param msg: Evaluated message as string given to the assert statement.


   :param bt: Backtrace of the assertion error. The top element will contain
       the location of the assert statement that failed.

   .. zeek:see:: assertion_result

.. zeek:type:: assertion_result
   :source-code: base/init-bare.zeek 1511 1511

   :Type: :zeek:type:`hook` (result: :zeek:type:`bool`, cond: :zeek:type:`string`, msg: :zeek:type:`string`, bt: :zeek:type:`Backtrace`) : :zeek:type:`bool`

   A hook that is invoked with the result of every assert statement.

   This is a potentially expensive hook meant to be used by testing
   frameworks to summarize assert results. In a production setup,
   this hook is likely detrimental to performance.

   Using the :zeek:see:`break` statement within an assertion_failure hook
   handler allows to suppress the reporter error message generated for
   failing assert statements.


   :param result: The result of evaluating **cond**.


   :param cond: The string representation of the condition.


   :param msg: Evaluated message as string given to the assert statement.


   :param bt: Backtrace of the assertion error. The top element will contain
       the location of the assert statement that failed.

   .. zeek:see:: assertion_failure

.. zeek:type:: bittorrent_benc_dir
   :source-code: base/init-bare.zeek 3417 3417

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`bittorrent_benc_value`

   A table of BitTorrent "benc" values.

   .. zeek:see:: bt_tracker_response

.. zeek:type:: bittorrent_benc_value
   :source-code: base/init-bare.zeek 3407 3412

   :Type: :zeek:type:`record`


   .. zeek:field:: i :zeek:type:`int` :zeek:attr:`&optional`

      TODO.


   .. zeek:field:: s :zeek:type:`string` :zeek:attr:`&optional`

      TODO.


   .. zeek:field:: d :zeek:type:`string` :zeek:attr:`&optional`

      TODO.


   .. zeek:field:: l :zeek:type:`string` :zeek:attr:`&optional`

      TODO.


   BitTorrent "benc" value. Note that "benc" = Bencode ("Bee-Encode"), per
   https://en.wikipedia.org/wiki/Bencode.

   .. zeek:see:: bittorrent_benc_dir

.. zeek:type:: bittorrent_peer
   :source-code: base/init-bare.zeek 3393 3396

   :Type: :zeek:type:`record`


   .. zeek:field:: h :zeek:type:`addr`

      The peer's address.


   .. zeek:field:: p :zeek:type:`port`

      The peer's port.


   A BitTorrent peer.

   .. zeek:see:: bittorrent_peer_set

.. zeek:type:: bittorrent_peer_set
   :source-code: base/init-bare.zeek 3401 3401

   :Type: :zeek:type:`set` [:zeek:type:`bittorrent_peer`]

   A set of BitTorrent peers.

   .. zeek:see:: bt_tracker_response

.. zeek:type:: bt_tracker_headers
   :source-code: base/init-bare.zeek 3423 3423

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`string`

   Header table type used by BitTorrent analyzer.

   .. zeek:see:: bt_tracker_request bt_tracker_response
      bt_tracker_response_not_ok

.. zeek:type:: call_argument
   :source-code: base/init-bare.zeek 1439 1448

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      The name of the parameter.


   .. zeek:field:: type_name :zeek:type:`string`

      The name of the parameters's type.


   .. zeek:field:: default_val :zeek:type:`any` :zeek:attr:`&optional`

      The value of the :zeek:attr:`&default` attribute if defined.


   .. zeek:field:: value :zeek:type:`any` :zeek:attr:`&optional`

      The value of the parameter as passed into a given call instance.
      Might be unset in the case a :zeek:attr:`&default` attribute is
      defined.


   Meta-information about a parameter to a function/event.

   .. zeek:see:: call_argument_vector new_event backtrace print_backtrace

.. zeek:type:: call_argument_vector
   :source-code: base/init-bare.zeek 1453 1453

   :Type: :zeek:type:`vector` of :zeek:type:`call_argument`

   Vector type used to capture parameters of a function/event call.

   .. zeek:see:: call_argument new_event backtrace print_backtrace

.. zeek:type:: conn_id
   :source-code: base/init-bare.zeek 224 231

   :Type: :zeek:type:`record`


   .. zeek:field:: orig_h :zeek:type:`addr` :zeek:attr:`&log`

      The originator's IP address.


   .. zeek:field:: orig_p :zeek:type:`port` :zeek:attr:`&log`

      The originator's port number.


   .. zeek:field:: resp_h :zeek:type:`addr` :zeek:attr:`&log`

      The responder's IP address.


   .. zeek:field:: resp_p :zeek:type:`port` :zeek:attr:`&log`

      The responder's port number.


   .. zeek:field:: proto :zeek:type:`count` :zeek:attr:`&default` = ``65535`` :zeek:attr:`&optional`

      The transport protocol ID. Defaults to 65535 as an "unknown" value.


   .. zeek:field:: ctx :zeek:type:`conn_id_ctx` :zeek:attr:`&log` :zeek:attr:`&default` = *...* :zeek:attr:`&optional`

      The context in which this connection exists.


   A connection's identifying 4-tuple of endpoints and ports.

   .. note:: It's actually a 5-tuple: the transport-layer protocol is stored as
      part of the port values, `orig_p` and `resp_p`, and can be extracted from
      them with :zeek:id:`get_port_transport_proto`.

   .. note:: For explanation of Zeek's "originator" and "responder" terminology,
      see :ref:`the manual's description of the connection record
      <writing-scripts-connection-record>`.

.. zeek:type:: conn_id_ctx
   :source-code: base/init-bare.zeek 213 214

   :Type: :zeek:type:`record`


   .. zeek:field:: vlan :zeek:type:`int` :zeek:attr:`&log` :zeek:attr:`&optional`

      (present if :doc:`/scripts/policy/frameworks/conn_key/vlan_fivetuple.zeek` is loaded)

      The outer VLAN for this connection, if applicable.


   .. zeek:field:: inner_vlan :zeek:type:`int` :zeek:attr:`&log` :zeek:attr:`&optional`

      (present if :doc:`/scripts/policy/frameworks/conn_key/vlan_fivetuple.zeek` is loaded)

      The inner VLAN for this connection, if applicable.


   A record type containing the context of a conn_id instance.

   This context is used to discriminate between :zeek:see:`conn_id` instances
   with identical five tuples, but not otherwise related due to, e.g. being observed
   on different VLANs, or within independent tunnel connections like VXLAN or Geneve.

   This record type is meant to be extended by custom ConnKey implementations.

.. zeek:type:: connection
   :source-code: base/init-bare.zeek 979 1014

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`conn_id`

      The connection's identifying 4-tuple.


   .. zeek:field:: orig :zeek:type:`endpoint`

      Statistics about originator side.


   .. zeek:field:: resp :zeek:type:`endpoint`

      Statistics about responder side.


   .. zeek:field:: start_time :zeek:type:`time`

      The timestamp of the connection's first packet.


   .. zeek:field:: duration :zeek:type:`interval`

      The duration of the conversation. Roughly speaking, this is the
      interval between first and last data packet (low-level TCP details
      may adjust it somewhat in ambiguous cases).


   .. zeek:field:: service :zeek:type:`set` [:zeek:type:`string`] :zeek:attr:`&ordered`

      The set of services the connection is using as determined by Zeek's
      dynamic protocol detection. Each entry is the label of an analyzer
      that confirmed that it could parse the connection payload.  While
      typically, there will be at most one entry for each connection, in
      principle it is possible that more than one protocol analyzer is able
      to parse the same data. If so, all will be recorded. Also note that
      the recorded services are independent of any transport-level protocols.


   .. zeek:field:: history :zeek:type:`string`

      State history of connections. See *history* in :zeek:see:`Conn::Info`.


   .. zeek:field:: uid :zeek:type:`string`

      A globally unique connection identifier. For each connection, Zeek
      creates an ID that is very likely unique across independent Zeek runs.
      These IDs can thus be used to tag and locate information associated
      with that connection.


   .. zeek:field:: tunnel :zeek:type:`EncapsulatingConnVector` :zeek:attr:`&optional`

      If the connection is tunneled, this field contains information about
      the encapsulating "connection(s)" with the outermost one starting
      at index zero.  It's also always the first such encapsulation seen
      for the connection unless the :zeek:id:`tunnel_changed` event is
      handled and reassigns this field to the new encapsulation.


   .. zeek:field:: vlan :zeek:type:`int` :zeek:attr:`&optional`

      The outer VLAN, if applicable for this connection.


   .. zeek:field:: inner_vlan :zeek:type:`int` :zeek:attr:`&optional`

      The inner VLAN, if applicable for this connection.


   .. zeek:field:: removal_hooks :zeek:type:`set` [:zeek:type:`Conn::RemovalHook`] :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/conn/removal-hooks.zeek` is loaded)


   .. zeek:field:: failed_analyzers :zeek:type:`set` [:zeek:type:`string`] :zeek:attr:`&default` = ``{  }`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/analyzer/dpd.zeek` is loaded)

      The set of prototol analyzers that were removed due to a protocol
      violation after the same analyzer had previously been confirmed.


   .. zeek:field:: conn :zeek:type:`Conn::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/conn/main.zeek` is loaded)


   .. zeek:field:: extract_orig :zeek:type:`bool` :zeek:attr:`&default` = :zeek:see:`Conn::default_extract` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/conn/contents.zeek` is loaded)


   .. zeek:field:: extract_resp :zeek:type:`bool` :zeek:attr:`&default` = :zeek:see:`Conn::default_extract` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/conn/contents.zeek` is loaded)


   .. zeek:field:: thresholds :zeek:type:`ConnThreshold::Thresholds` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/conn/thresholds.zeek` is loaded)


   .. zeek:field:: dce_rpc :zeek:type:`DCE_RPC::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dce-rpc/main.zeek` is loaded)


   .. zeek:field:: dce_rpc_state :zeek:type:`DCE_RPC::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dce-rpc/main.zeek` is loaded)


   .. zeek:field:: dce_rpc_backing :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`DCE_RPC::BackingState` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dce-rpc/main.zeek` is loaded)


   .. zeek:field:: dhcp :zeek:type:`DHCP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dhcp/main.zeek` is loaded)


   .. zeek:field:: dnp3 :zeek:type:`DNP3::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dnp3/main.zeek` is loaded)


   .. zeek:field:: dns :zeek:type:`DNS::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dns/main.zeek` is loaded)


   .. zeek:field:: dns_state :zeek:type:`DNS::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/dns/main.zeek` is loaded)


   .. zeek:field:: ftp :zeek:type:`FTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ftp/main.zeek` is loaded)


   .. zeek:field:: ftp_data_reuse :zeek:type:`bool` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ftp/main.zeek` is loaded)


   .. zeek:field:: ssl :zeek:type:`SSL::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ssl/main.zeek` is loaded)


   .. zeek:field:: http :zeek:type:`HTTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/http/main.zeek` is loaded)


   .. zeek:field:: http_state :zeek:type:`HTTP::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/http/main.zeek` is loaded)


   .. zeek:field:: irc :zeek:type:`IRC::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/irc/main.zeek` is loaded)

      IRC session information.


   .. zeek:field:: krb :zeek:type:`KRB::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/krb/main.zeek` is loaded)


   .. zeek:field:: ldap :zeek:type:`LDAP::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ldap/main.zeek` is loaded)


   .. zeek:field:: modbus :zeek:type:`Modbus::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/modbus/main.zeek` is loaded)


   .. zeek:field:: mqtt :zeek:type:`MQTT::ConnectInfo` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/mqtt/main.zeek` is loaded)


   .. zeek:field:: mqtt_state :zeek:type:`MQTT::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/mqtt/main.zeek` is loaded)


   .. zeek:field:: mysql :zeek:type:`MySQL::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/mysql/main.zeek` is loaded)


   .. zeek:field:: ntlm :zeek:type:`NTLM::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ntlm/main.zeek` is loaded)


   .. zeek:field:: ntp :zeek:type:`NTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ntp/main.zeek` is loaded)


   .. zeek:field:: ntp_control :zeek:type:`NTP::ControlInfo` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ntp/main.zeek` is loaded)


   .. zeek:field:: ntp_private :zeek:type:`NTP::PrivateInfo` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ntp/main.zeek` is loaded)


   .. zeek:field:: postgresql :zeek:type:`PostgreSQL::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/postgresql/main.zeek` is loaded)


   .. zeek:field:: postgresql_state :zeek:type:`PostgreSQL::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/postgresql/main.zeek` is loaded)


   .. zeek:field:: quic :zeek:type:`QUIC::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/quic/main.zeek` is loaded)


   .. zeek:field:: radius :zeek:type:`RADIUS::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/radius/main.zeek` is loaded)


   .. zeek:field:: rdp :zeek:type:`RDP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/rdp/main.zeek` is loaded)


   .. zeek:field:: redis :zeek:type:`Redis::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/redis/main.zeek` is loaded)


   .. zeek:field:: redis_state :zeek:type:`Redis::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/redis/main.zeek` is loaded)


   .. zeek:field:: rfb :zeek:type:`RFB::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/rfb/main.zeek` is loaded)


   .. zeek:field:: sip :zeek:type:`SIP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/sip/main.zeek` is loaded)


   .. zeek:field:: sip_state :zeek:type:`SIP::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/sip/main.zeek` is loaded)


   .. zeek:field:: snmp :zeek:type:`SNMP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/snmp/main.zeek` is loaded)


   .. zeek:field:: smb_state :zeek:type:`SMB::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/smb/main.zeek` is loaded)


   .. zeek:field:: smtp :zeek:type:`SMTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/smtp/main.zeek` is loaded)


   .. zeek:field:: smtp_state :zeek:type:`SMTP::State` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/smtp/main.zeek` is loaded)


   .. zeek:field:: socks :zeek:type:`SOCKS::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/socks/main.zeek` is loaded)


   .. zeek:field:: ssh :zeek:type:`SSH::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ssh/main.zeek` is loaded)


   .. zeek:field:: syslog :zeek:type:`Syslog::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/syslog/main.zeek` is loaded)


   .. zeek:field:: websocket :zeek:type:`WebSocket::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/websocket/main.zeek` is loaded)


   .. zeek:field:: packet_segment :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      (present if :doc:`/scripts/policy/frameworks/analyzer/packet-segment-logging.zeek` is loaded)

      A chunk of the payload that most likely resulted in a
      analyzer violation.


   .. zeek:field:: known_services_done :zeek:type:`bool` :zeek:attr:`&default` = ``F`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/policy/protocols/conn/known-services.zeek` is loaded)


   .. zeek:field:: multicast_srcs :zeek:type:`set` [:zeek:type:`addr`] :zeek:attr:`&optional`

      (present if :doc:`/scripts/policy/protocols/conn/multicast-participants.zeek` is loaded)


   .. zeek:field:: speculative_service :zeek:type:`set` [:zeek:type:`string`] :zeek:attr:`&default` = ``{  }`` :zeek:attr:`&optional`

      (present if :doc:`/scripts/policy/protocols/conn/speculative-service.zeek` is loaded)


   A connection. This is Zeek's basic connection type describing IP- and
   transport-layer information about the conversation. Note that Zeek uses a
   liberal interpretation of "connection" and associates instances of this type
   also with UDP and ICMP flows.

   .. note::

       As of version 8.1, Zeek's core does not reliably keep the duration and
       history fields of connection records up-to-date. This means that within
       early connection events, protocol analyzer events or scheduled events,
       these fields may be stale and not reflect the most recent values as
       stored within Zeek's core after processing a packet.

       If you use duration or history in such event handlers, the workaround to
       get the most recent values is to execute the ``lookup_connection()`` function
       within a handler which will refresh the script-layer records to what
       the core holds::

           # Refresh dynamic fields on the connection and endpoint records
           event new_connection(c: connection) {
               print c$history;  # Prints "" - stale.

               local _ = lookup_connection(c$id);

               print c$history;  # Prints "S" for a TCP connection starting with a SYN packet.
           }

       References to issues and PRs with a description, ideas and discussions:

         * https://github.com/zeek/zeek/issues/4214
         * https://github.com/zeek/zeek/issues/4786
         * https://github.com/zeek/zeek/pull/4785
         * https://github.com/zeek/zeek/pull/4788
         * https://github.com/zeek/zeek/pull/4886


.. zeek:type:: connection_timing_out
   :source-code: base/init-bare.zeek 1818 1818

   :Type: :zeek:type:`hook` (c: :zeek:type:`connection`) : :zeek:type:`bool`

   A hook that can be used to veto timing out a connection via :zeek:see:`break`.
   The connection will then wait another inactivity interval until attempting
   another timeout.


   :param c: The connection

   .. zeek:see:: tcp_inactivity_timeout udp_inactivity_timeout icmp_inactivity_timeout unknown_ip_inactivity_timeout set_inactivity_timeout

.. zeek:type:: count_set
   :source-code: base/init-bare.zeek 47 47

   :Type: :zeek:type:`set` [:zeek:type:`count`]

   A set of counts.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: dns_answer
   :source-code: base/init-bare.zeek 3279 3287

   :Type: :zeek:type:`record`


   .. zeek:field:: answer_type :zeek:type:`count`

      Answer type. One of :zeek:see:`DNS_QUERY`, :zeek:see:`DNS_ANS`,
      :zeek:see:`DNS_AUTH` and :zeek:see:`DNS_ADDL`.


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: qtype :zeek:type:`count`

      Query type.


   .. zeek:field:: qclass :zeek:type:`count`

      Query class.


   .. zeek:field:: TTL :zeek:type:`interval`

      Time-to-live.


   The general part of a DNS reply.

   .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply
      dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply
      dns_TXT_reply dns_WKS_reply

.. zeek:type:: dns_binds_rr
   :source-code: base/init-bare.zeek 3196 3204

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: algorithm :zeek:type:`count`

      Algorithm for Public Key.


   .. zeek:field:: key_id :zeek:type:`count`

      key tag.


   .. zeek:field:: removal_flag :zeek:type:`count`

      rm flag.


   .. zeek:field:: complete_flag :zeek:type:`count`

      complete flag.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A Private RR type BINDS record.

   .. zeek:see:: dns_BINDS

.. zeek:type:: dns_dnskey_rr
   :source-code: base/init-bare.zeek 3139 3147

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: flags :zeek:type:`count`

      flags filed.


   .. zeek:field:: protocol :zeek:type:`count`

      Protocol, should be always 3 for DNSSEC.


   .. zeek:field:: algorithm :zeek:type:`count`

      Algorithm for Public Key.


   .. zeek:field:: public_key :zeek:type:`string`

      Public Key


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNSSEC DNSKEY record.

   .. zeek:see:: dns_DNSKEY

.. zeek:type:: dns_ds_rr
   :source-code: base/init-bare.zeek 3183 3191

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: key_tag :zeek:type:`count`

      flags filed.


   .. zeek:field:: algorithm :zeek:type:`count`

      Algorithm for Public Key.


   .. zeek:field:: digest_type :zeek:type:`count`

      Digest Type.


   .. zeek:field:: digest_val :zeek:type:`string`

      Digest Value.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNSSEC DS record.

   .. zeek:see:: dns_DS

.. zeek:type:: dns_edns_additional
   :source-code: base/init-bare.zeek 3050 3060

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: qtype :zeek:type:`count`

      Query type.


   .. zeek:field:: t :zeek:type:`count`

      TODO.


   .. zeek:field:: payload_size :zeek:type:`count`

      TODO.


   .. zeek:field:: extended_rcode :zeek:type:`count`

      Extended return code.


   .. zeek:field:: version :zeek:type:`count`

      Version.


   .. zeek:field:: z_field :zeek:type:`count`

      TODO.


   .. zeek:field:: TTL :zeek:type:`interval`

      Time-to-live.


   .. zeek:field:: is_query :zeek:type:`count`

      TODO.


   An additional DNS EDNS record.

   .. zeek:see:: dns_EDNS_addl

.. zeek:type:: dns_edns_cookie
   :source-code: base/init-bare.zeek 3083 3086

   :Type: :zeek:type:`record`


   .. zeek:field:: client_cookie :zeek:type:`string`

      Cookie from the client (fixed 8 bytes).


   .. zeek:field:: server_cookie :zeek:type:`string` :zeek:attr:`&default` = ``""`` :zeek:attr:`&optional`

      Cookie from the server (0 bytes if missing, or 8 to 32 bytes).


   An DNS EDNS COOKIE (COOKIE) record.

   .. zeek:see:: dns_EDNS_cookie

.. zeek:type:: dns_edns_ecs
   :source-code: base/init-bare.zeek 3065 3070

   :Type: :zeek:type:`record`


   .. zeek:field:: family :zeek:type:`string`

      IP Family


   .. zeek:field:: source_prefix_len :zeek:type:`count`

      Source Prefix Length.


   .. zeek:field:: scope_prefix_len :zeek:type:`count`

      Scope Prefix Length.


   .. zeek:field:: address :zeek:type:`addr`

      Client Subnet Address.


   An DNS EDNS Client Subnet (ECS) record.

   .. zeek:see:: dns_EDNS_ecs

.. zeek:type:: dns_edns_tcp_keepalive
   :source-code: base/init-bare.zeek 3075 3078

   :Type: :zeek:type:`record`


   .. zeek:field:: keepalive_timeout_omitted :zeek:type:`bool`

      Whether timeout value is omitted.


   .. zeek:field:: keepalive_timeout :zeek:type:`count`

      Timeout value, in 100ms.


   An DNS EDNS TCP KEEPALIVE (TCP KEEPALIVE) record.

   .. zeek:see:: dns_EDNS_tcp_keepalive

.. zeek:type:: dns_loc_rr
   :source-code: base/init-bare.zeek 3209 3220

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: version :zeek:type:`count`

      version number of the representation.


   .. zeek:field:: size :zeek:type:`count`

      Diameter of a sphere enclosing the entity.


   .. zeek:field:: horiz_pre :zeek:type:`count`

      The horizontal precision of the data, in centimeters.


   .. zeek:field:: vert_pre :zeek:type:`count`

      The vertical precision of the data, in centimeters.


   .. zeek:field:: latitude :zeek:type:`count`

      The latitude of the center of the sphere.


   .. zeek:field:: longitude :zeek:type:`count`

      The longitude of the center of the sphere.


   .. zeek:field:: altitude :zeek:type:`count`

      The altitude of the center of the sphere.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A Private RR type LOC record.

   .. zeek:see:: dns_LOC

.. zeek:type:: dns_mapping
   :source-code: base/init-bare.zeek 367 386

   :Type: :zeek:type:`record`


   .. zeek:field:: creation_time :zeek:type:`time`

      The time when the mapping was created, which corresponds to when
      the DNS query was sent out.


   .. zeek:field:: req_host :zeek:type:`string`

      If the mapping is the result of a name lookup, the queried host name;
      otherwise empty.


   .. zeek:field:: req_addr :zeek:type:`addr`

      If the mapping is the result of a pointer lookup, the queried
      address; otherwise null.


   .. zeek:field:: valid :zeek:type:`bool`

      True if the lookup returned success. Only then are the result fields
      valid.


   .. zeek:field:: hostname :zeek:type:`string`

      If the mapping is the result of a pointer lookup, the resolved
      hostname; otherwise empty.


   .. zeek:field:: addrs :zeek:type:`addr_set`

      If the mapping is the result of an address lookup, the resolved
      address(es); otherwise empty.



.. zeek:type:: dns_msg
   :source-code: base/init-bare.zeek 3011 3032

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`count`

      Transaction ID.


   .. zeek:field:: opcode :zeek:type:`count`

      Operation code.


   .. zeek:field:: rcode :zeek:type:`count`

      Return code.


   .. zeek:field:: QR :zeek:type:`bool`

      Query response flag.


   .. zeek:field:: AA :zeek:type:`bool`

      Authoritative answer flag.


   .. zeek:field:: TC :zeek:type:`bool`

      Truncated packet flag.


   .. zeek:field:: RD :zeek:type:`bool`

      Recursion desired flag.


   .. zeek:field:: RA :zeek:type:`bool`

      Recursion available flag.


   .. zeek:field:: Z :zeek:type:`count`

      3 bit field (includes AD and CD)


   .. zeek:field:: AD :zeek:type:`bool`

      authentic data


   .. zeek:field:: CD :zeek:type:`bool`

      checking disabled


   .. zeek:field:: num_queries :zeek:type:`count`

      Number of query records. For dynamic update messages, this is the number of zones.


   .. zeek:field:: num_answers :zeek:type:`count`

      Number of answer records. For dynamic update messages, this is the number of prerequisites.


   .. zeek:field:: num_auth :zeek:type:`count`

      Number of authoritative records. For dynamic update messages, this is the number of updates.


   .. zeek:field:: num_addl :zeek:type:`count`

      Number of additional records.


   .. zeek:field:: is_netbios :zeek:type:`bool`

      Whether this message came from NetBIOS.


   A DNS message.

   .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
      dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
      dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end
      dns_message dns_query_reply dns_rejected dns_request dns_dynamic_update

.. zeek:type:: dns_naptr_rr
   :source-code: base/init-bare.zeek 3253 3260

   :Type: :zeek:type:`record`


   .. zeek:field:: order :zeek:type:`count`

      Order in which to process NAPTR records.


   .. zeek:field:: preference :zeek:type:`count`

      Preference specifying processing order for *equal* :zeek:field:`dns_naptr_rr$order` fields.


   .. zeek:field:: flags :zeek:type:`string`

      Flags to control rewriting. E.g. "u", "a", "s" or "p".


   .. zeek:field:: service :zeek:type:`string`

      The services available down this rewrite path.


   .. zeek:field:: regexp :zeek:type:`string`

      Substitution expression to be applied to the original query.


   .. zeek:field:: replacement :zeek:type:`string`

      The next name to query, where the type is depending on the :zeek:field:`dns_naptr_rr$flags` field.


   A NAPTR record.

   See also RFC 2915 - The Naming Authority Pointer (NAPTR) DNS Resource Record.

   .. zeek:see:: dns_NAPTR_reply

.. zeek:type:: dns_nsec3_rr
   :source-code: base/init-bare.zeek 3152 3164

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: nsec_flags :zeek:type:`count`

      flags field.


   .. zeek:field:: nsec_hash_algo :zeek:type:`count`

      Hash algorithm.


   .. zeek:field:: nsec_iter :zeek:type:`count`

      Iterations.


   .. zeek:field:: nsec_salt_len :zeek:type:`count`

      Salt length.


   .. zeek:field:: nsec_salt :zeek:type:`string`

      Salt value


   .. zeek:field:: nsec_hlen :zeek:type:`count`

      Hash length.


   .. zeek:field:: nsec_hash :zeek:type:`string`

      Hash value.


   .. zeek:field:: bitmaps :zeek:type:`string_vec`

      Type Bit Maps.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNSSEC NSEC3 record.

   .. zeek:see:: dns_NSEC3

.. zeek:type:: dns_nsec3param_rr
   :source-code: base/init-bare.zeek 3169 3178

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: nsec_flags :zeek:type:`count`

      flags field.


   .. zeek:field:: nsec_hash_algo :zeek:type:`count`

      Hash algorithm.


   .. zeek:field:: nsec_iter :zeek:type:`count`

      Iterations.


   .. zeek:field:: nsec_salt_len :zeek:type:`count`

      Salt length.


   .. zeek:field:: nsec_salt :zeek:type:`string`

      Salt value


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNSSEC NSEC3PARAM record.

   .. zeek:see:: dns_NSEC3PARAM

.. zeek:type:: dns_rrsig_rr
   :source-code: base/init-bare.zeek 3121 3134

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: answer_type :zeek:type:`count`

      Ans type.


   .. zeek:field:: type_covered :zeek:type:`count`

      qtype covered by RRSIG RR.


   .. zeek:field:: algorithm :zeek:type:`count`

      Algorithm.


   .. zeek:field:: labels :zeek:type:`count`

      Labels in the owner's name.


   .. zeek:field:: orig_ttl :zeek:type:`interval`

      Original TTL.


   .. zeek:field:: sig_exp :zeek:type:`time`

      Time when signed RR expires.


   .. zeek:field:: sig_incep :zeek:type:`time`

      Time when signed.


   .. zeek:field:: key_tag :zeek:type:`count`

      Key tag value.


   .. zeek:field:: signer_name :zeek:type:`string`

      Signature.


   .. zeek:field:: signature :zeek:type:`string`

      Hash of the RRDATA.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNSSEC RRSIG record.

   .. zeek:see:: dns_RRSIG

.. zeek:type:: dns_soa
   :source-code: base/init-bare.zeek 3037 3045

   :Type: :zeek:type:`record`


   .. zeek:field:: mname :zeek:type:`string`

      Primary source of data for zone.


   .. zeek:field:: rname :zeek:type:`string`

      Mailbox for responsible person.


   .. zeek:field:: serial :zeek:type:`count`

      Version number of zone.


   .. zeek:field:: refresh :zeek:type:`interval`

      Seconds before refreshing.


   .. zeek:field:: retry :zeek:type:`interval`

      How long before retrying failed refresh.


   .. zeek:field:: expire :zeek:type:`interval`

      When zone no longer authoritative.


   .. zeek:field:: minimum :zeek:type:`interval`

      Minimum TTL to use when exporting.


   A DNS SOA record.

   .. zeek:see:: dns_SOA_reply

.. zeek:type:: dns_svcb_param
   :source-code: base/init-bare.zeek 3225 3233

   :Type: :zeek:type:`record`


   .. zeek:field:: key :zeek:type:`count`

      SvcParamKey


   .. zeek:field:: mandatory :zeek:type:`vector` of :zeek:type:`count` :zeek:attr:`&optional`

      "mandatory" SvcParamKey values


   .. zeek:field:: alpn :zeek:type:`vector` of :zeek:type:`string` :zeek:attr:`&optional`

      "alpn" IDs


   .. zeek:field:: p :zeek:type:`count` :zeek:attr:`&optional`

      "port" number, TCP or UDP


   .. zeek:field:: hint :zeek:type:`vector` of :zeek:type:`addr` :zeek:attr:`&optional`

      "ipv4hint" or "ipv6hint" IP addresses


   .. zeek:field:: ech :zeek:type:`string` :zeek:attr:`&optional`

      "ech" base64 encoded ECHConfigList blob


   .. zeek:field:: raw :zeek:type:`string` :zeek:attr:`&optional`

      reserved key's or malformed value


   A SvcParamKey with an optional SvcParamValue.
   .. zeek:see:: dns_svcb_rr

.. zeek:type:: dns_svcb_param_vec
   :source-code: base/init-bare.zeek 3235 3235

   :Type: :zeek:type:`vector` of :zeek:type:`dns_svcb_param`


.. zeek:type:: dns_svcb_rr
   :source-code: base/init-bare.zeek 3242 3246

   :Type: :zeek:type:`record`


   .. zeek:field:: svc_priority :zeek:type:`count`

      Service priority. If zero, the record is in AliasMode and has no SvcParam.


   .. zeek:field:: target_name :zeek:type:`string`

      Target name, the hostname of the service endpoint.


   .. zeek:field:: svc_params :zeek:type:`dns_svcb_param_vec` :zeek:attr:`&optional`

      Service parameters, if any.


   A SVCB or HTTPS record.

   See also RFC 9460 - Service Binding and Parameter Specification via the DNS (SVCB and HTTPS Resource Records).

   .. zeek:see:: dns_SVCB dns_HTTPS

.. zeek:type:: dns_tkey
   :source-code: base/init-bare.zeek 3091 3101

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: qtype :zeek:type:`count`

      Query type.


   .. zeek:field:: alg_name :zeek:type:`string`

      Algorithm name.


   .. zeek:field:: inception :zeek:type:`time`

      Requested or provided start of validity interval for keying material.


   .. zeek:field:: expiration :zeek:type:`time`

      Requested or provided end of validity interval for keying material.


   .. zeek:field:: mode :zeek:type:`count`

      Key agreement or purpose of the message.


   .. zeek:field:: rr_error :zeek:type:`count`

      Error code.


   .. zeek:field:: key_data :zeek:type:`string`

      Key exchange data field.


   .. zeek:field:: is_query :zeek:type:`count`

      The RR is a query/Response.


   A DNS TKEY record.

   .. zeek:see:: dns_TKEY

.. zeek:type:: dns_tsig_additional
   :source-code: base/init-bare.zeek 3106 3116

   :Type: :zeek:type:`record`


   .. zeek:field:: query :zeek:type:`string`

      Query.


   .. zeek:field:: qtype :zeek:type:`count`

      Query type.


   .. zeek:field:: alg_name :zeek:type:`string`

      Algorithm name.


   .. zeek:field:: sig :zeek:type:`string`

      Signature.


   .. zeek:field:: time_signed :zeek:type:`time`

      Time when signed.


   .. zeek:field:: fudge :zeek:type:`time`

      TODO.


   .. zeek:field:: orig_id :zeek:type:`count`

      TODO.


   .. zeek:field:: rr_error :zeek:type:`count`

      TODO.


   .. zeek:field:: is_query :zeek:type:`count`

      TODO.


   An additional DNS TSIG record.

   .. zeek:see:: dns_TSIG_addl

.. zeek:type:: double_vec
   :source-code: base/init-bare.zeek 68 68

   :Type: :zeek:type:`vector` of :zeek:type:`double`

   A vector of floating point numbers, used by telemetry builtin functions to store histogram bounds.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: endpoint
   :source-code: base/init-bare.zeek 923 942

   :Type: :zeek:type:`record`


   .. zeek:field:: size :zeek:type:`count`

      Logical size of data sent (for TCP: derived from sequence numbers).


   .. zeek:field:: state :zeek:type:`count`

      Endpoint state. For a TCP connection, one of the constants:
      :zeek:see:`TCP_INACTIVE` :zeek:see:`TCP_SYN_SENT`
      :zeek:see:`TCP_SYN_ACK_SENT` :zeek:see:`TCP_PARTIAL`
      :zeek:see:`TCP_ESTABLISHED` :zeek:see:`TCP_CLOSED` :zeek:see:`TCP_RESET`.
      For UDP, one of :zeek:see:`UDP_ACTIVE` and :zeek:see:`UDP_INACTIVE`.


   .. zeek:field:: num_pkts :zeek:type:`count` :zeek:attr:`&optional`

      Number of packets sent. Only set if :zeek:id:`use_conn_size_analyzer`
      is true.


   .. zeek:field:: num_bytes_ip :zeek:type:`count` :zeek:attr:`&optional`

      Number of IP-level bytes sent. Only set if
      :zeek:id:`use_conn_size_analyzer` is true.


   .. zeek:field:: flow_label :zeek:type:`count`

      The current IPv6 flow label that the connection endpoint is using.
      Always 0 if the connection is over IPv4.


   .. zeek:field:: l2_addr :zeek:type:`string` :zeek:attr:`&optional`

      The link-layer address seen in the first packet (if available).


   Statistics about a :zeek:type:`connection` endpoint.

   .. note::

       As of version 8.1, Zeek does not reliably keep the state, num_pkts and
       num_bytes_ip fields of endpoint records up-to-date. This means that within
       early connection events, protocol analyzer events or scheduled events,
       these fields may be stale and not reflect the most recent values as stored
       within Zeek's core after processing a packet.

       Most notably, the packet and byte counts in a ``new_connection()`` handler
       are zero, rather than non-zero for the originator endpoint of a connection.
       The same applies to protocol analyzer events: The packet counts may not
       include the packet that raised the event.

       If you use packet or byte counts in event handlers, the workaround to
       get the most recent values on the endpoint records is to execute the
       ``lookup_connection()`` function within a handler which will refresh
       the script-layer records to what the core holds::

           # Refresh dynamic fields on the connection and endpoint records
           event new_connection(c: connection) {
               print c$orig$num_pkts;  # Prints 0 - stale.

               local _ = lookup_connection(c$id);

               print c$orig$num_pkts;  # Prints 1.
           }

       References to issues and PRs with a description, ideas and discussions:

         * https://github.com/zeek/zeek/issues/4214
         * https://github.com/zeek/zeek/issues/4786
         * https://github.com/zeek/zeek/pull/4785
         * https://github.com/zeek/zeek/pull/4788
         * https://github.com/zeek/zeek/pull/4886

   .. zeek:see:: connection

.. zeek:type:: endpoint_stats
   :source-code: base/init-bare.zeek 402 414

   :Type: :zeek:type:`record`


   .. zeek:field:: num_pkts :zeek:type:`count`

      Number of packets.


   .. zeek:field:: num_rxmit :zeek:type:`count`

      Number of retransmissions.


   .. zeek:field:: num_rxmit_bytes :zeek:type:`count`

      Number of retransmitted bytes.


   .. zeek:field:: num_in_order :zeek:type:`count`

      Number of in-order packets.


   .. zeek:field:: num_OO :zeek:type:`count`

      Number of out-of-order packets.


   .. zeek:field:: num_repl :zeek:type:`count`

      Number of replicated packets (last packet was sent again).


   .. zeek:field:: endian_type :zeek:type:`count`

      Endian type used by the endpoint, if it could be determined from
      the sequence numbers used. This is one of :zeek:see:`ENDIAN_UNKNOWN`,
      :zeek:see:`ENDIAN_BIG`, :zeek:see:`ENDIAN_LITTLE`, and
      :zeek:see:`ENDIAN_CONFUSED`.


   Statistics about what a TCP endpoint sent.

   .. zeek:see:: conn_stats

.. zeek:type:: entropy_test_result
   :source-code: base/init-bare.zeek 1683 1689

   :Type: :zeek:type:`record`


   .. zeek:field:: entropy :zeek:type:`double`

      Information density.


   .. zeek:field:: chi_square :zeek:type:`double`

      Chi-Square value.


   .. zeek:field:: mean :zeek:type:`double`

      Arithmetic Mean.


   .. zeek:field:: monte_carlo_pi :zeek:type:`double`

      Monte-carlo value for pi.


   .. zeek:field:: serial_correlation :zeek:type:`double`

      Serial correlation coefficient.


   Computed entropy values. The record captures a number of measures that are
   computed in parallel. See `A Pseudorandom Number Sequence Test Program
   <https://www.fourmilab.ch/random>`_ for more information, Zeek uses the same
   code.

   .. zeek:see:: entropy_test_add entropy_test_finish entropy_test_init find_entropy

.. zeek:type:: event_metadata_vec
   :source-code: base/init-bare.zeek 883 883

   :Type: :zeek:type:`vector` of :zeek:type:`EventMetadata::Entry`

   A type alias for event metadata.

.. zeek:type:: fa_file
   :source-code: base/init-bare.zeek 1030 1082

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`string`

      A hash serving as the identifier associated with a single file.


   .. zeek:field:: parent_id :zeek:type:`string` :zeek:attr:`&optional`

      Identifier associated with a container file from which this one was
      extracted as part of the file analysis.


   .. zeek:field:: source :zeek:type:`string`

      An identification of the source of the file data. E.g. it may be
      a network protocol over which it was transferred, or a local file
      path including filename which was read, or some other input source.
      Examples are: "HTTP", "SMTP", "IRC_DATA", or the filename, or even
      the full path and filename.


   .. zeek:field:: is_orig :zeek:type:`bool` :zeek:attr:`&optional`

      If the source of this file is a network connection, this field
      may be set to indicate the directionality.


   .. zeek:field:: conns :zeek:type:`table` [:zeek:type:`conn_id`] of :zeek:type:`connection` :zeek:attr:`&optional`

      The set of connections over which the file was transferred.


   .. zeek:field:: last_active :zeek:type:`time`

      The time at which the last activity for the file was seen.


   .. zeek:field:: seen_bytes :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Number of bytes provided to the file analysis engine for the file.


   .. zeek:field:: total_bytes :zeek:type:`count` :zeek:attr:`&optional`

      Total number of bytes that are supposed to comprise the full file.


   .. zeek:field:: missing_bytes :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      The number of bytes in the file stream that were completely missed
      during the process of analysis e.g. due to dropped packets.


   .. zeek:field:: overflow_bytes :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      The number of bytes in the file stream that were not delivered to
      stream file analyzers.  Generally, this consists of bytes that
      couldn't be reassembled, either because reassembly simply isn't
      enabled, or due to size limitations of the reassembly buffer.


   .. zeek:field:: timeout_interval :zeek:type:`interval` :zeek:attr:`&default` = :zeek:see:`default_file_timeout_interval` :zeek:attr:`&optional`

      The amount of time between receiving new data for this file that
      the analysis engine will wait before giving up on it.


   .. zeek:field:: bof_buffer_size :zeek:type:`count` :zeek:attr:`&default` = :zeek:see:`default_file_bof_buffer_size` :zeek:attr:`&optional`

      The number of bytes at the beginning of a file to save for later
      inspection in the *bof_buffer* field.


   .. zeek:field:: bof_buffer :zeek:type:`string` :zeek:attr:`&optional`

      The content of the beginning of a file up to *bof_buffer_size* bytes.
      This is also the buffer that's used for file/mime type detection.


   .. zeek:field:: info :zeek:type:`Files::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/frameworks/files/main.zeek` is loaded)


   .. zeek:field:: ftp :zeek:type:`FTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/ftp/files.zeek` is loaded)


   .. zeek:field:: http :zeek:type:`HTTP::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/http/entities.zeek` is loaded)


   .. zeek:field:: irc :zeek:type:`IRC::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/protocols/irc/files.zeek` is loaded)


   .. zeek:field:: pe :zeek:type:`PE::Info` :zeek:attr:`&optional`

      (present if :doc:`/scripts/base/files/pe/main.zeek` is loaded)

   :Attributes: :zeek:attr:`&redef`

   File Analysis handle for a file that Zeek is analyzing. This holds
   information about, but not the content of, a conceptual "file";
   essentially any byte stream that is e.g. pulled from a network connection
   or possibly some other input source. Note that fa_file is also used in
   cases where there isn't a filename to be had.

.. zeek:type:: fa_metadata
   :source-code: base/init-bare.zeek 1092 1100

   :Type: :zeek:type:`record`


   .. zeek:field:: mime_type :zeek:type:`string` :zeek:attr:`&optional`

      The strongest matching MIME type if one was discovered.


   .. zeek:field:: mime_types :zeek:type:`mime_matches` :zeek:attr:`&optional`

      All matching MIME types if any were discovered.


   .. zeek:field:: inferred :zeek:type:`bool` :zeek:attr:`&default` = ``T`` :zeek:attr:`&optional`

      Specifies whether the MIME type was inferred using signatures,
      or provided directly by the protocol the file appeared in.


   File Analysis metadata that's been inferred about a particular file.

.. zeek:type:: files_tag_set
   :source-code: base/init-bare.zeek 125 125

   :Type: :zeek:type:`set` [:zeek:type:`Files::Tag`]

   A set of file analyzer tags.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: flow_id
   :source-code: base/init-bare.zeek 238 243

   :Type: :zeek:type:`record`


   .. zeek:field:: src_h :zeek:type:`addr` :zeek:attr:`&log`

      The source IP address.


   .. zeek:field:: src_p :zeek:type:`port` :zeek:attr:`&log`

      The source port number.


   .. zeek:field:: dst_h :zeek:type:`addr` :zeek:attr:`&log`

      The destination IP address.


   .. zeek:field:: dst_p :zeek:type:`port` :zeek:attr:`&log`

      The destination port number.

   :Attributes: :zeek:attr:`&log`

   The identifying 4-tuple of a uni-directional flow.

   .. note:: It's actually a 5-tuple: the transport-layer protocol is stored as
      part of the port values, `src_p` and `dst_p`, and can be extracted from
      them with :zeek:id:`get_port_transport_proto`.

.. zeek:type:: from_json_result
   :source-code: base/init-bare.zeek 1700 1704

   :Type: :zeek:type:`record`


   .. zeek:field:: v :zeek:type:`any` :zeek:attr:`&optional`

      Parsed value.


   .. zeek:field:: valid :zeek:type:`bool`

      True if parsing was successful.


   .. zeek:field:: err :zeek:type:`string` :zeek:attr:`&optional`


   Return type for from_json BIF.

   .. zeek:see:: from_json

.. zeek:type:: ftp_port
   :source-code: base/init-bare.zeek 393 397

   :Type: :zeek:type:`record`


   .. zeek:field:: h :zeek:type:`addr`

      The host's address.


   .. zeek:field:: p :zeek:type:`port`

      The host's port.


   .. zeek:field:: valid :zeek:type:`bool`

      True if format was right. Only then are *h* and *p* valid.


   A parsed host/port combination describing server endpoint for an upcoming
   data transfer.

   .. zeek:see:: fmt_ftp_port parse_eftp_port parse_ftp_epsv parse_ftp_pasv
      parse_ftp_port

.. zeek:type:: geo_autonomous_system
   :source-code: base/init-bare.zeek 1645 1648

   :Type: :zeek:type:`record`


   .. zeek:field:: number :zeek:type:`count` :zeek:attr:`&optional` :zeek:attr:`&log`

      The autonomous system number.


   .. zeek:field:: organization :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      Associated organization.

   :Attributes: :zeek:attr:`&log`

   GeoIP autonomous system information.

   .. zeek:see:: lookup_autonomous_system

.. zeek:type:: geo_location
   :source-code: base/init-bare.zeek 1634 1640

   :Type: :zeek:type:`record`


   .. zeek:field:: country_code :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      The country code.


   .. zeek:field:: region :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      The region.


   .. zeek:field:: city :zeek:type:`string` :zeek:attr:`&optional` :zeek:attr:`&log`

      The city.


   .. zeek:field:: latitude :zeek:type:`double` :zeek:attr:`&optional` :zeek:attr:`&log`

      Latitude.


   .. zeek:field:: longitude :zeek:type:`double` :zeek:attr:`&optional` :zeek:attr:`&log`

      Longitude.

   :Attributes: :zeek:attr:`&log`

   GeoIP location information.

   .. zeek:see:: lookup_location

.. zeek:type:: gtp_access_point_name
   :source-code: base/init-bare.zeek 2543 2543

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_cause
   :source-code: base/init-bare.zeek 2525 2525

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_charging_characteristics
   :source-code: base/init-bare.zeek 2541 2541

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_charging_gateway_addr
   :source-code: base/init-bare.zeek 2533 2533

   :Type: :zeek:type:`addr`


.. zeek:type:: gtp_charging_id
   :source-code: base/init-bare.zeek 2532 2532

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_create_pdp_ctx_request_elements
   :source-code: base/init-bare.zeek 2581 2604

   :Type: :zeek:type:`record`


   .. zeek:field:: imsi :zeek:type:`gtp_imsi` :zeek:attr:`&optional`


   .. zeek:field:: rai :zeek:type:`gtp_rai` :zeek:attr:`&optional`


   .. zeek:field:: recovery :zeek:type:`gtp_recovery` :zeek:attr:`&optional`


   .. zeek:field:: select_mode :zeek:type:`gtp_selection_mode` :zeek:attr:`&optional`


   .. zeek:field:: data1 :zeek:type:`gtp_teid1`


   .. zeek:field:: cp :zeek:type:`gtp_teid_control_plane` :zeek:attr:`&optional`


   .. zeek:field:: nsapi :zeek:type:`gtp_nsapi`


   .. zeek:field:: linked_nsapi :zeek:type:`gtp_nsapi` :zeek:attr:`&optional`


   .. zeek:field:: charge_character :zeek:type:`gtp_charging_characteristics` :zeek:attr:`&optional`


   .. zeek:field:: trace_ref :zeek:type:`gtp_trace_reference` :zeek:attr:`&optional`


   .. zeek:field:: trace_type :zeek:type:`gtp_trace_type` :zeek:attr:`&optional`


   .. zeek:field:: end_user_addr :zeek:type:`gtp_end_user_addr` :zeek:attr:`&optional`


   .. zeek:field:: ap_name :zeek:type:`gtp_access_point_name` :zeek:attr:`&optional`


   .. zeek:field:: opts :zeek:type:`gtp_proto_config_options` :zeek:attr:`&optional`


   .. zeek:field:: signal_addr :zeek:type:`gtp_gsn_addr`


   .. zeek:field:: user_addr :zeek:type:`gtp_gsn_addr`


   .. zeek:field:: msisdn :zeek:type:`gtp_msisdn` :zeek:attr:`&optional`


   .. zeek:field:: qos_prof :zeek:type:`gtp_qos_profile`


   .. zeek:field:: tft :zeek:type:`gtp_tft` :zeek:attr:`&optional`


   .. zeek:field:: trigger_id :zeek:type:`gtp_trigger_id` :zeek:attr:`&optional`


   .. zeek:field:: omc_id :zeek:type:`gtp_omc_id` :zeek:attr:`&optional`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`



.. zeek:type:: gtp_create_pdp_ctx_response_elements
   :source-code: base/init-bare.zeek 2606 2620

   :Type: :zeek:type:`record`


   .. zeek:field:: cause :zeek:type:`gtp_cause`


   .. zeek:field:: reorder_req :zeek:type:`gtp_reordering_required` :zeek:attr:`&optional`


   .. zeek:field:: recovery :zeek:type:`gtp_recovery` :zeek:attr:`&optional`


   .. zeek:field:: data1 :zeek:type:`gtp_teid1` :zeek:attr:`&optional`


   .. zeek:field:: cp :zeek:type:`gtp_teid_control_plane` :zeek:attr:`&optional`


   .. zeek:field:: charging_id :zeek:type:`gtp_charging_id` :zeek:attr:`&optional`


   .. zeek:field:: end_user_addr :zeek:type:`gtp_end_user_addr` :zeek:attr:`&optional`


   .. zeek:field:: opts :zeek:type:`gtp_proto_config_options` :zeek:attr:`&optional`


   .. zeek:field:: cp_addr :zeek:type:`gtp_gsn_addr` :zeek:attr:`&optional`


   .. zeek:field:: user_addr :zeek:type:`gtp_gsn_addr` :zeek:attr:`&optional`


   .. zeek:field:: qos_prof :zeek:type:`gtp_qos_profile` :zeek:attr:`&optional`


   .. zeek:field:: charge_gateway :zeek:type:`gtp_charging_gateway_addr` :zeek:attr:`&optional`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`



.. zeek:type:: gtp_delete_pdp_ctx_request_elements
   :source-code: base/init-bare.zeek 2654 2658

   :Type: :zeek:type:`record`


   .. zeek:field:: teardown_ind :zeek:type:`gtp_teardown_ind` :zeek:attr:`&optional`


   .. zeek:field:: nsapi :zeek:type:`gtp_nsapi`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`



.. zeek:type:: gtp_delete_pdp_ctx_response_elements
   :source-code: base/init-bare.zeek 2660 2663

   :Type: :zeek:type:`record`


   .. zeek:field:: cause :zeek:type:`gtp_cause`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`



.. zeek:type:: gtp_end_user_addr
   :source-code: base/init-bare.zeek 2555 2562

   :Type: :zeek:type:`record`


   .. zeek:field:: pdp_type_org :zeek:type:`count`


   .. zeek:field:: pdp_type_num :zeek:type:`count`


   .. zeek:field:: pdp_ip :zeek:type:`addr` :zeek:attr:`&optional`

      Set if the End User Address information element is IPv4/IPv6.


   .. zeek:field:: pdp_other_addr :zeek:type:`string` :zeek:attr:`&optional`

      Set if the End User Address information element isn't IPv4/IPv6.



.. zeek:type:: gtp_gsn_addr
   :source-code: base/init-bare.zeek 2546 2553

   :Type: :zeek:type:`record`


   .. zeek:field:: ip :zeek:type:`addr` :zeek:attr:`&optional`

      If the GSN Address information element has length 4 or 16, then this
      field is set to be the informational element's value interpreted as
      an IPv4 or IPv6 address, respectively.


   .. zeek:field:: other :zeek:type:`string` :zeek:attr:`&optional`

      This field is set if it's not an IPv4 or IPv6 address.



.. zeek:type:: gtp_imsi
   :source-code: base/init-bare.zeek 2526 2526

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_msisdn
   :source-code: base/init-bare.zeek 2544 2544

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_nsapi
   :source-code: base/init-bare.zeek 2528 2528

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_omc_id
   :source-code: base/init-bare.zeek 2538 2538

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_private_extension
   :source-code: base/init-bare.zeek 2576 2579

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`count`


   .. zeek:field:: value :zeek:type:`string`



.. zeek:type:: gtp_proto_config_options
   :source-code: base/init-bare.zeek 2540 2540

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_qos_profile
   :source-code: base/init-bare.zeek 2571 2574

   :Type: :zeek:type:`record`


   .. zeek:field:: priority :zeek:type:`count`


   .. zeek:field:: data :zeek:type:`string`



.. zeek:type:: gtp_rai
   :source-code: base/init-bare.zeek 2564 2569

   :Type: :zeek:type:`record`


   .. zeek:field:: mcc :zeek:type:`count`


   .. zeek:field:: mnc :zeek:type:`count`


   .. zeek:field:: lac :zeek:type:`count`


   .. zeek:field:: rac :zeek:type:`count`



.. zeek:type:: gtp_recovery
   :source-code: base/init-bare.zeek 2529 2529

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_reordering_required
   :source-code: base/init-bare.zeek 2539 2539

   :Type: :zeek:type:`bool`


.. zeek:type:: gtp_selection_mode
   :source-code: base/init-bare.zeek 2542 2542

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_teardown_ind
   :source-code: base/init-bare.zeek 2527 2527

   :Type: :zeek:type:`bool`


.. zeek:type:: gtp_teid1
   :source-code: base/init-bare.zeek 2530 2530

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_teid_control_plane
   :source-code: base/init-bare.zeek 2531 2531

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_tft
   :source-code: base/init-bare.zeek 2536 2536

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_trace_reference
   :source-code: base/init-bare.zeek 2534 2534

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_trace_type
   :source-code: base/init-bare.zeek 2535 2535

   :Type: :zeek:type:`count`


.. zeek:type:: gtp_trigger_id
   :source-code: base/init-bare.zeek 2537 2537

   :Type: :zeek:type:`string`


.. zeek:type:: gtp_update_pdp_ctx_request_elements
   :source-code: base/init-bare.zeek 2622 2639

   :Type: :zeek:type:`record`


   .. zeek:field:: imsi :zeek:type:`gtp_imsi` :zeek:attr:`&optional`


   .. zeek:field:: rai :zeek:type:`gtp_rai` :zeek:attr:`&optional`


   .. zeek:field:: recovery :zeek:type:`gtp_recovery` :zeek:attr:`&optional`


   .. zeek:field:: data1 :zeek:type:`gtp_teid1`


   .. zeek:field:: cp :zeek:type:`gtp_teid_control_plane` :zeek:attr:`&optional`


   .. zeek:field:: nsapi :zeek:type:`gtp_nsapi`


   .. zeek:field:: trace_ref :zeek:type:`gtp_trace_reference` :zeek:attr:`&optional`


   .. zeek:field:: trace_type :zeek:type:`gtp_trace_type` :zeek:attr:`&optional`


   .. zeek:field:: cp_addr :zeek:type:`gtp_gsn_addr`


   .. zeek:field:: user_addr :zeek:type:`gtp_gsn_addr`


   .. zeek:field:: qos_prof :zeek:type:`gtp_qos_profile`


   .. zeek:field:: tft :zeek:type:`gtp_tft` :zeek:attr:`&optional`


   .. zeek:field:: trigger_id :zeek:type:`gtp_trigger_id` :zeek:attr:`&optional`


   .. zeek:field:: omc_id :zeek:type:`gtp_omc_id` :zeek:attr:`&optional`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`


   .. zeek:field:: end_user_addr :zeek:type:`gtp_end_user_addr` :zeek:attr:`&optional`



.. zeek:type:: gtp_update_pdp_ctx_response_elements
   :source-code: base/init-bare.zeek 2641 2652

   :Type: :zeek:type:`record`


   .. zeek:field:: cause :zeek:type:`gtp_cause`


   .. zeek:field:: recovery :zeek:type:`gtp_recovery` :zeek:attr:`&optional`


   .. zeek:field:: data1 :zeek:type:`gtp_teid1` :zeek:attr:`&optional`


   .. zeek:field:: cp :zeek:type:`gtp_teid_control_plane` :zeek:attr:`&optional`


   .. zeek:field:: charging_id :zeek:type:`gtp_charging_id` :zeek:attr:`&optional`


   .. zeek:field:: cp_addr :zeek:type:`gtp_gsn_addr` :zeek:attr:`&optional`


   .. zeek:field:: user_addr :zeek:type:`gtp_gsn_addr` :zeek:attr:`&optional`


   .. zeek:field:: qos_prof :zeek:type:`gtp_qos_profile` :zeek:attr:`&optional`


   .. zeek:field:: charge_gateway :zeek:type:`gtp_charging_gateway_addr` :zeek:attr:`&optional`


   .. zeek:field:: ext :zeek:type:`gtp_private_extension` :zeek:attr:`&optional`



.. zeek:type:: gtpv1_hdr
   :source-code: base/init-bare.zeek 2488 2523

   :Type: :zeek:type:`record`


   .. zeek:field:: version :zeek:type:`count`

      The 3-bit version field, which for GTPv1 should be 1.


   .. zeek:field:: pt_flag :zeek:type:`bool`

      Protocol Type value differentiates GTP (value 1) from GTP' (value 0).


   .. zeek:field:: rsv :zeek:type:`bool`

      Reserved field, should be 0.


   .. zeek:field:: e_flag :zeek:type:`bool`

      Extension Header flag.  When 0, the *next_type* field may or may not
      be present, but shouldn't be meaningful.  When 1, *next_type* is
      present and meaningful.


   .. zeek:field:: s_flag :zeek:type:`bool`

      Sequence Number flag.  When 0, the *seq* field may or may not
      be present, but shouldn't be meaningful.  When 1, *seq* is
      present and meaningful.


   .. zeek:field:: pn_flag :zeek:type:`bool`

      N-PDU flag.  When 0, the *n_pdu* field may or may not
      be present, but shouldn't be meaningful.  When 1, *n_pdu* is
      present and meaningful.


   .. zeek:field:: msg_type :zeek:type:`count`

      Message Type.  A value of 255 indicates user-plane data is encapsulated.


   .. zeek:field:: length :zeek:type:`count`

      Length of the GTP packet payload (the rest of the packet following
      the mandatory 8-byte GTP header).


   .. zeek:field:: teid :zeek:type:`count`

      Tunnel Endpoint Identifier.  Unambiguously identifies a tunnel
      endpoint in receiving GTP-U or GTP-C protocol entity.


   .. zeek:field:: seq :zeek:type:`count` :zeek:attr:`&optional`

      Sequence Number.  Set if any *e_flag*, *s_flag*, or *pn_flag* field
      is set.


   .. zeek:field:: n_pdu :zeek:type:`count` :zeek:attr:`&optional`

      N-PDU Number.  Set if any *e_flag*, *s_flag*, or *pn_flag* field is set.


   .. zeek:field:: next_type :zeek:type:`count` :zeek:attr:`&optional`

      Next Extension Header Type.  Set if any *e_flag*, *s_flag*, or
      *pn_flag* field is set.


   A GTPv1 (GPRS Tunneling Protocol) header.

.. zeek:type:: http_message_stat
   :source-code: base/init-bare.zeek 3332 3345

   :Type: :zeek:type:`record`


   .. zeek:field:: start :zeek:type:`time`

      When the request/reply line was complete.


   .. zeek:field:: interrupted :zeek:type:`bool`

      Whether the message was interrupted.


   .. zeek:field:: finish_msg :zeek:type:`string`

      Reason phrase if interrupted.


   .. zeek:field:: body_length :zeek:type:`count`

      Length of body processed (before finished/interrupted).


   .. zeek:field:: content_gap_length :zeek:type:`count`

      Total length of gaps within *body_length*.


   .. zeek:field:: header_length :zeek:type:`count`

      Length of headers (including the req/reply line, but not CR/LF's).


   HTTP message statistics.

   .. zeek:see:: http_message_done

.. zeek:type:: http_stats_rec
   :source-code: base/init-bare.zeek 3322 3327

   :Type: :zeek:type:`record`


   .. zeek:field:: num_requests :zeek:type:`count`

      Number of requests.


   .. zeek:field:: num_replies :zeek:type:`count`

      Number of replies.


   .. zeek:field:: request_version :zeek:type:`double`

      HTTP version of the requests.


   .. zeek:field:: reply_version :zeek:type:`double`

      HTTP Version of the replies.


   HTTP session statistics.

   .. zeek:see:: http_stats

.. zeek:type:: icmp6_mldv2_group_type
   :source-code: base/init-bare.zeek 334 342

   :Type: :zeek:type:`enum`

      .. zeek:enum:: MLDV2_MODE_IS_INCLUDE icmp6_mldv2_group_type

      .. zeek:enum:: MLDV2_MODE_IS_EXCLUDE icmp6_mldv2_group_type

      .. zeek:enum:: MLDV2_CHANGE_TO_INCLUDE_MODE icmp6_mldv2_group_type

      .. zeek:enum:: MLDV2_CHANGE_TO_EXCLUDE_MODE icmp6_mldv2_group_type

      .. zeek:enum:: MLDV2_ALLOW_NEW_SOURCES icmp6_mldv2_group_type

      .. zeek:enum:: MLDV2_BLOCK_OLD_SOURCES icmp6_mldv2_group_type

   ICMPv6 MLD Version 2 Multicast Address Record types, as defined in
   :rfc:`3810#section-5.2.12`

.. zeek:type:: icmp6_mldv2_mar
   :source-code: base/init-bare.zeek 345 358

   :Type: :zeek:type:`record`


   .. zeek:field:: group_type :zeek:type:`icmp6_mldv2_group_type`

      The type of the multicast record being reported.


   .. zeek:field:: aux_data_len :zeek:type:`count`

      The length of the auxiliary data field in this group record, in bytes.


   .. zeek:field:: num_sources :zeek:type:`count`

      The number of source addresses.


   .. zeek:field:: multicast_addr :zeek:type:`addr`

      The multicast address to which this record pertains.


   .. zeek:field:: sources :zeek:type:`addr_vec`

      A vector of source addresses.


   .. zeek:field:: aux_data :zeek:type:`string` :zeek:attr:`&optional`

      Additional information pertaining to this record.


   ICMPv6 MLD Version 2 Multicast Address Record, as defined in
   :rfc:`3810#section-5.2`

.. zeek:type:: icmp6_mldv2_mar_vec
   :source-code: base/init-bare.zeek 360 360

   :Type: :zeek:type:`vector` of :zeek:type:`icmp6_mldv2_mar`


.. zeek:type:: icmp6_nd_option
   :source-code: base/init-bare.zeek 306 327

   :Type: :zeek:type:`record`


   .. zeek:field:: otype :zeek:type:`count`

      8-bit identifier of the type of option.


   .. zeek:field:: len :zeek:type:`count`

      8-bit integer representing the length of the option (including the
      type and length fields) in units of 8 octets.


   .. zeek:field:: link_address :zeek:type:`string` :zeek:attr:`&optional`

      Source Link-Layer Address (Type 1) or Target Link-Layer Address (Type 2).
      Byte ordering of this is dependent on the actual link-layer.


   .. zeek:field:: prefix :zeek:type:`icmp6_nd_prefix_info` :zeek:attr:`&optional`

      Prefix Information (Type 3).


   .. zeek:field:: redirect :zeek:type:`icmp_context` :zeek:attr:`&optional`

      Redirected header (Type 4).  This field contains the context of the
      original, redirected packet.


   .. zeek:field:: mtu :zeek:type:`count` :zeek:attr:`&optional`

      Recommended MTU for the link (Type 5).


   .. zeek:field:: payload :zeek:type:`string` :zeek:attr:`&optional`

      The raw data of the option (everything after type & length fields),
      useful for unknown option types or when the full option payload is
      truncated in the captured packet.  In those cases, option fields
      won't be pre-extracted into the fields above.


   Options extracted from ICMPv6 neighbor discovery messages as specified
   by :rfc:`4861`.

   .. zeek:see:: icmp_router_solicitation icmp_router_advertisement
      icmp_neighbor_advertisement icmp_neighbor_solicitation icmp_redirect
      icmp6_nd_options

.. zeek:type:: icmp6_nd_options
   :source-code: base/init-bare.zeek 330 330

   :Type: :zeek:type:`vector` of :zeek:type:`icmp6_nd_option`

   A type alias for a vector of ICMPv6 neighbor discovery message options.

.. zeek:type:: icmp6_nd_prefix_info
   :source-code: base/init-bare.zeek 281 298

   :Type: :zeek:type:`record`


   .. zeek:field:: prefix_len :zeek:type:`count`

      Number of leading bits of the *prefix* that are valid.


   .. zeek:field:: L_flag :zeek:type:`bool`

      Flag indicating the prefix can be used for on-link determination.


   .. zeek:field:: A_flag :zeek:type:`bool`

      Autonomous address-configuration flag.


   .. zeek:field:: valid_lifetime :zeek:type:`interval`

      Length of time in seconds that the prefix is valid for purpose of
      on-link determination (0xffffffff represents infinity).


   .. zeek:field:: preferred_lifetime :zeek:type:`interval`

      Length of time in seconds that the addresses generated from the
      prefix via stateless address autoconfiguration remain preferred
      (0xffffffff represents infinity).


   .. zeek:field:: prefix :zeek:type:`addr`

      An IP address or prefix of an IP address.  Use the *prefix_len* field
      to convert this into a :zeek:type:`subnet`.


   Values extracted from a Prefix Information option in an ICMPv6 neighbor
   discovery message as specified by :rfc:`4861`.

   .. zeek:see:: icmp6_nd_option

.. zeek:type:: icmp_context
   :source-code: base/init-bare.zeek 262 275

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`conn_id`

      The packet's 4-tuple.


   .. zeek:field:: len :zeek:type:`count`

      The length of the IP packet (headers + payload).


   .. zeek:field:: proto :zeek:type:`count`

      The packet's transport-layer protocol.


   .. zeek:field:: frag_offset :zeek:type:`count`

      The packet's fragmentation offset.


   .. zeek:field:: bad_hdr_len :zeek:type:`bool`

      True if the packet's IP header is not fully included in the context
      or if there is not enough of the transport header to determine source
      and destination ports. If that is the case, the appropriate fields
      of this record will be set to null values.


   .. zeek:field:: bad_checksum :zeek:type:`bool`

      True if the packet's IP checksum is not correct.


   .. zeek:field:: MF :zeek:type:`bool`

      True if the packet's *more fragments* flag is set.


   .. zeek:field:: DF :zeek:type:`bool`

      True if the packet's *don't fragment* flag is set.


   Packet context part of an ICMP message. The fields of this record reflect the
   packet that is described by the context.

   .. zeek:see:: icmp_time_exceeded icmp_unreachable

.. zeek:type:: icmp_hdr
   :source-code: base/init-bare.zeek 2404 2406

   :Type: :zeek:type:`record`


   .. zeek:field:: icmp_type :zeek:type:`count`

      type of message


   Values extracted from an ICMP header.

   .. zeek:see:: pkt_hdr discarder_check_icmp

.. zeek:type:: icmp_info
   :source-code: base/init-bare.zeek 250 256

   :Type: :zeek:type:`record`


   .. zeek:field:: v6 :zeek:type:`bool`

      True if it's an ICMPv6 packet.


   .. zeek:field:: itype :zeek:type:`count`

      The ICMP type of the current packet.


   .. zeek:field:: icode :zeek:type:`count`

      The ICMP code of the current packet.


   .. zeek:field:: len :zeek:type:`count`

      The length of the ICMP payload.


   .. zeek:field:: ttl :zeek:type:`count`

      The encapsulating IP header's TTL (IPv4) or Hop Limit (IPv6).


   Specifics about an ICMP conversation/packet.
   ICMP events typically pass this in addition to :zeek:type:`conn_id`.

   .. zeek:see:: icmp_echo_reply icmp_echo_request icmp_redirect icmp_sent
      icmp_time_exceeded icmp_unreachable

.. zeek:type:: id_table
   :source-code: base/init-bare.zeek 1411 1411

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`script_id`

   Table type used to map script-level identifiers to meta-information
   describing them.

   .. zeek:see:: global_ids script_id

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: index_vec
   :source-code: base/init-bare.zeek 54 54

   :Type: :zeek:type:`vector` of :zeek:type:`count`

   A vector of counts, used by some builtin functions to store a list of indices.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: int_vec
   :source-code: base/init-bare.zeek 61 61

   :Type: :zeek:type:`vector` of :zeek:type:`int`

   A vector of integers, used by telemetry builtin functions to store histogram bounds.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: interval_set
   :source-code: base/init-bare.zeek 132 132

   :Type: :zeek:type:`set` [:zeek:type:`interval`]

   A set of intervals.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: ip4_hdr
   :source-code: base/init-bare.zeek 2351 2364

   :Type: :zeek:type:`record`


   .. zeek:field:: hl :zeek:type:`count`

      Header length in bytes.


   .. zeek:field:: tos :zeek:type:`count`

      Type of service.


   .. zeek:field:: len :zeek:type:`count`

      Total length.


   .. zeek:field:: id :zeek:type:`count`

      Identification.


   .. zeek:field:: DF :zeek:type:`bool`

      True if the packet's *don't fragment* flag is set.


   .. zeek:field:: MF :zeek:type:`bool`

      True if the packet's *more fragments* flag is set.


   .. zeek:field:: offset :zeek:type:`count`

      Fragment offset.


   .. zeek:field:: ttl :zeek:type:`count`

      Time to live.


   .. zeek:field:: p :zeek:type:`count`

      Protocol.


   .. zeek:field:: sum :zeek:type:`count`

      Checksum.


   .. zeek:field:: src :zeek:type:`addr`

      Source address.


   .. zeek:field:: dst :zeek:type:`addr`

      Destination address.


   Values extracted from an IPv4 header.

   .. zeek:see:: pkt_hdr ip6_hdr discarder_check_ip

.. zeek:type:: ip6_ah
   :source-code: base/init-bare.zeek 2125 2139

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: len :zeek:type:`count`

      Length of header in 4-octet units, excluding first two units.


   .. zeek:field:: rsv :zeek:type:`count`

      Reserved field.


   .. zeek:field:: spi :zeek:type:`count`

      Security Parameter Index.


   .. zeek:field:: seq :zeek:type:`count` :zeek:attr:`&optional`

      Sequence number, unset in the case that *len* field is zero.


   .. zeek:field:: data :zeek:type:`string` :zeek:attr:`&optional`

      Authentication data, unset in the case that *len* field is zero.


   Values extracted from an IPv6 Authentication extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: ip6_dstopts
   :source-code: base/init-bare.zeek 2076 2084

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: len :zeek:type:`count`

      Length of header in 8-octet units, excluding first unit.


   .. zeek:field:: options :zeek:type:`ip6_options`

      The TLV encoded options;


   Values extracted from an IPv6 Destination options extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option

.. zeek:type:: ip6_esp
   :source-code: base/init-bare.zeek 2144 2149

   :Type: :zeek:type:`record`


   .. zeek:field:: spi :zeek:type:`count`

      Security Parameters Index.


   .. zeek:field:: seq :zeek:type:`count`

      Sequence number.


   Values extracted from an IPv6 ESP extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: ip6_ext_hdr
   :source-code: base/init-bare.zeek 2308 2326

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`count`

      The RFC 1700 et seq. IANA assigned number identifying the type of
      the extension header.


   .. zeek:field:: hopopts :zeek:type:`ip6_hopopts` :zeek:attr:`&optional`

      Hop-by-hop option extension header.


   .. zeek:field:: dstopts :zeek:type:`ip6_dstopts` :zeek:attr:`&optional`

      Destination option extension header.


   .. zeek:field:: routing :zeek:type:`ip6_routing` :zeek:attr:`&optional`

      Routing extension header.


   .. zeek:field:: fragment :zeek:type:`ip6_fragment` :zeek:attr:`&optional`

      Fragment header.


   .. zeek:field:: ah :zeek:type:`ip6_ah` :zeek:attr:`&optional`

      Authentication extension header.


   .. zeek:field:: esp :zeek:type:`ip6_esp` :zeek:attr:`&optional`

      Encapsulating security payload header.


   .. zeek:field:: mobility :zeek:type:`ip6_mobility_hdr` :zeek:attr:`&optional`

      Mobility header.


   A general container for a more specific IPv6 extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hopopts ip6_dstopts ip6_routing ip6_fragment
      ip6_ah ip6_esp

.. zeek:type:: ip6_ext_hdr_chain
   :source-code: base/init-bare.zeek 2329 2329

   :Type: :zeek:type:`vector` of :zeek:type:`ip6_ext_hdr`

   A type alias for a vector of IPv6 extension headers.

.. zeek:type:: ip6_fragment
   :source-code: base/init-bare.zeek 2106 2120

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: rsv1 :zeek:type:`count`

      8-bit reserved field.


   .. zeek:field:: offset :zeek:type:`count`

      Fragmentation offset.


   .. zeek:field:: rsv2 :zeek:type:`count`

      2-bit reserved field.


   .. zeek:field:: more :zeek:type:`bool`

      More fragments.


   .. zeek:field:: id :zeek:type:`count`

      Fragment identification.


   Values extracted from an IPv6 Fragment extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: ip6_hdr
   :source-code: base/init-bare.zeek 2335 2346

   :Type: :zeek:type:`record`


   .. zeek:field:: class :zeek:type:`count`

      Traffic class.


   .. zeek:field:: flow :zeek:type:`count`

      Flow label.


   .. zeek:field:: len :zeek:type:`count`

      Payload length.


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header
      (RFC 1700 et seq., IANA assigned number)
      e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: hlim :zeek:type:`count`

      Hop limit.


   .. zeek:field:: src :zeek:type:`addr`

      Source address.


   .. zeek:field:: dst :zeek:type:`addr`

      Destination address.


   .. zeek:field:: exts :zeek:type:`ip6_ext_hdr_chain`

      Extension header chain.


   Values extracted from an IPv6 header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts
      ip6_routing ip6_fragment ip6_ah ip6_esp

.. zeek:type:: ip6_hopopts
   :source-code: base/init-bare.zeek 2063 2071

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: len :zeek:type:`count`

      Length of header in 8-octet units, excluding first unit.


   .. zeek:field:: options :zeek:type:`ip6_options`

      The TLV encoded options;


   Values extracted from an IPv6 Hop-by-Hop options extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr ip6_option

.. zeek:type:: ip6_mobility_back
   :source-code: base/init-bare.zeek 2236 2247

   :Type: :zeek:type:`record`


   .. zeek:field:: status :zeek:type:`count`

      Status.


   .. zeek:field:: k :zeek:type:`bool`

      Key Management Mobility Capability.


   .. zeek:field:: seq :zeek:type:`count`

      Sequence number.


   .. zeek:field:: life :zeek:type:`count`

      Lifetime.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Binding Acknowledgement message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_be
   :source-code: base/init-bare.zeek 2252 2259

   :Type: :zeek:type:`record`


   .. zeek:field:: status :zeek:type:`count`

      Status.


   .. zeek:field:: hoa :zeek:type:`addr`

      Home Address.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Binding Error message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_brr
   :source-code: base/init-bare.zeek 2154 2159

   :Type: :zeek:type:`record`


   .. zeek:field:: rsv :zeek:type:`count`

      Reserved.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Binding Refresh Request message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_bu
   :source-code: base/init-bare.zeek 2216 2231

   :Type: :zeek:type:`record`


   .. zeek:field:: seq :zeek:type:`count`

      Sequence number.


   .. zeek:field:: a :zeek:type:`bool`

      Acknowledge bit.


   .. zeek:field:: h :zeek:type:`bool`

      Home Registration bit.


   .. zeek:field:: l :zeek:type:`bool`

      Link-Local Address Compatibility bit.


   .. zeek:field:: k :zeek:type:`bool`

      Key Management Mobility Capability bit.


   .. zeek:field:: life :zeek:type:`count`

      Lifetime.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Binding Update message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_cot
   :source-code: base/init-bare.zeek 2202 2211

   :Type: :zeek:type:`record`


   .. zeek:field:: nonce_idx :zeek:type:`count`

      Care-of Nonce Index.


   .. zeek:field:: cookie :zeek:type:`count`

      Care-of Init Cookie.


   .. zeek:field:: token :zeek:type:`count`

      Care-of Keygen Token.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Care-of Test message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_coti
   :source-code: base/init-bare.zeek 2176 2183

   :Type: :zeek:type:`record`


   .. zeek:field:: rsv :zeek:type:`count`

      Reserved.


   .. zeek:field:: cookie :zeek:type:`count`

      Care-of Init Cookie.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Care-of Test Init message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_hdr
   :source-code: base/init-bare.zeek 2288 2302

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: len :zeek:type:`count`

      Length of header in 8-octet units, excluding first unit.


   .. zeek:field:: mh_type :zeek:type:`count`

      Mobility header type used to identify header's the message.


   .. zeek:field:: rsv :zeek:type:`count`

      Reserved field.


   .. zeek:field:: chksum :zeek:type:`count`

      Mobility header checksum.


   .. zeek:field:: msg :zeek:type:`ip6_mobility_msg`

      Mobility header message


   Values extracted from an IPv6 Mobility header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: ip6_mobility_hot
   :source-code: base/init-bare.zeek 2188 2197

   :Type: :zeek:type:`record`


   .. zeek:field:: nonce_idx :zeek:type:`count`

      Home Nonce Index.


   .. zeek:field:: cookie :zeek:type:`count`

      Home Init Cookie.


   .. zeek:field:: token :zeek:type:`count`

      Home Keygen Token.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Home Test message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_hoti
   :source-code: base/init-bare.zeek 2164 2171

   :Type: :zeek:type:`record`


   .. zeek:field:: rsv :zeek:type:`count`

      Reserved.


   .. zeek:field:: cookie :zeek:type:`count`

      Home Init Cookie.


   .. zeek:field:: options :zeek:type:`vector` of :zeek:type:`ip6_option`

      Mobility Options.


   Values extracted from an IPv6 Mobility Home Test Init message.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr ip6_mobility_msg

.. zeek:type:: ip6_mobility_msg
   :source-code: base/init-bare.zeek 2264 2283

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`count`

      The type of message from the header's MH Type field.


   .. zeek:field:: brr :zeek:type:`ip6_mobility_brr` :zeek:attr:`&optional`

      Binding Refresh Request.


   .. zeek:field:: hoti :zeek:type:`ip6_mobility_hoti` :zeek:attr:`&optional`

      Home Test Init.


   .. zeek:field:: coti :zeek:type:`ip6_mobility_coti` :zeek:attr:`&optional`

      Care-of Test Init.


   .. zeek:field:: hot :zeek:type:`ip6_mobility_hot` :zeek:attr:`&optional`

      Home Test.


   .. zeek:field:: cot :zeek:type:`ip6_mobility_cot` :zeek:attr:`&optional`

      Care-of Test.


   .. zeek:field:: bu :zeek:type:`ip6_mobility_bu` :zeek:attr:`&optional`

      Binding Update.


   .. zeek:field:: back :zeek:type:`ip6_mobility_back` :zeek:attr:`&optional`

      Binding Acknowledgement.


   .. zeek:field:: be :zeek:type:`ip6_mobility_be` :zeek:attr:`&optional`

      Binding Error.


   Values extracted from an IPv6 Mobility header's message data.

   .. zeek:see:: ip6_mobility_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: ip6_option
   :source-code: base/init-bare.zeek 2051 2055

   :Type: :zeek:type:`record`


   .. zeek:field:: otype :zeek:type:`count`

      Option type.


   .. zeek:field:: len :zeek:type:`count`

      Option data length.


   .. zeek:field:: data :zeek:type:`string`

      Option data.


   Values extracted from an IPv6 extension header's (e.g. hop-by-hop or
   destination option headers) option field.

   .. zeek:see:: ip6_hdr ip6_ext_hdr ip6_hopopts ip6_dstopts

.. zeek:type:: ip6_options
   :source-code: base/init-bare.zeek 2058 2058

   :Type: :zeek:type:`vector` of :zeek:type:`ip6_option`

   A type alias for a vector of IPv6 options.

.. zeek:type:: ip6_routing
   :source-code: base/init-bare.zeek 2089 2101

   :Type: :zeek:type:`record`


   .. zeek:field:: nxt :zeek:type:`count`

      Protocol number of the next header (RFC 1700 et seq., IANA assigned
      number), e.g. :zeek:id:`IPPROTO_ICMP`.


   .. zeek:field:: len :zeek:type:`count`

      Length of header in 8-octet units, excluding first unit.


   .. zeek:field:: rtype :zeek:type:`count`

      Routing type.


   .. zeek:field:: segleft :zeek:type:`count`

      Segments left.


   .. zeek:field:: data :zeek:type:`string`

      Type-specific data.


   Values extracted from an IPv6 Routing extension header.

   .. zeek:see:: pkt_hdr ip4_hdr ip6_hdr ip6_ext_hdr

.. zeek:type:: irc_join_info
   :source-code: base/init-bare.zeek 3368 3373

   :Type: :zeek:type:`record`


   .. zeek:field:: nick :zeek:type:`string`


   .. zeek:field:: channel :zeek:type:`string`


   .. zeek:field:: password :zeek:type:`string`


   .. zeek:field:: usermode :zeek:type:`string`


   IRC join information.

   .. zeek:see:: irc_join_list

.. zeek:type:: irc_join_list
   :source-code: base/init-bare.zeek 3378 3378

   :Type: :zeek:type:`set` [:zeek:type:`irc_join_info`]

   Set of IRC join information.

   .. zeek:see:: irc_join_message

.. zeek:type:: l2_hdr
   :source-code: base/init-bare.zeek 2422 2436

   :Type: :zeek:type:`record`


   .. zeek:field:: encap :zeek:type:`link_encap`

      L2 link encapsulation.


   .. zeek:field:: len :zeek:type:`count`

      Total frame length on wire.


   .. zeek:field:: cap_len :zeek:type:`count`

      Captured length.


   .. zeek:field:: src :zeek:type:`string` :zeek:attr:`&optional`

      L2 source (if Ethernet).


   .. zeek:field:: dst :zeek:type:`string` :zeek:attr:`&optional`

      L2 destination (if Ethernet).


   .. zeek:field:: vlan :zeek:type:`count` :zeek:attr:`&optional`

      Outermost VLAN tag if any (and Ethernet).


   .. zeek:field:: vlan_pcp :zeek:type:`count` :zeek:attr:`&optional`

      Outermost VLAN PCP if vlan header is present.


   .. zeek:field:: vlan_dei :zeek:type:`bool` :zeek:attr:`&optional`

      Outermost VLAN DEI if vlan header is present.


   .. zeek:field:: inner_vlan :zeek:type:`count` :zeek:attr:`&optional`

      Innermost VLAN tag if any (and Ethernet).


   .. zeek:field:: inner_vlan_pcp :zeek:type:`count` :zeek:attr:`&optional`

      Innermost VLAN PCP if inner vlan header is present.


   .. zeek:field:: inner_vlan_dei :zeek:type:`bool` :zeek:attr:`&optional`

      Innermost VLAN DEI if inner vlan header is present.


   .. zeek:field:: eth_type :zeek:type:`count` :zeek:attr:`&optional`

      Innermost Ethertype (if Ethernet).


   .. zeek:field:: proto :zeek:type:`layer3_proto`

      L3 protocol.


   Values extracted from the layer 2 header.

   .. zeek:see:: pkt_hdr

.. zeek:type:: mime_header_list
   :source-code: base/init-bare.zeek 2889 2889

   :Type: :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`mime_header_rec`

   A list of MIME headers.

   .. zeek:see:: mime_header_rec http_all_headers mime_all_headers

.. zeek:type:: mime_header_rec
   :source-code: base/init-bare.zeek 2880 2884

   :Type: :zeek:type:`record`


   .. zeek:field:: original_name :zeek:type:`string`

      The header name (unaltered).


   .. zeek:field:: name :zeek:type:`string`

      The header name (converted to all upper-case).


   .. zeek:field:: value :zeek:type:`string`

      The header value.


   A MIME header key/value pair.

   .. zeek:see:: mime_header_list http_all_headers mime_all_headers mime_one_header

.. zeek:type:: mime_match
   :source-code: base/init-bare.zeek 145 150

   :Type: :zeek:type:`record`


   .. zeek:field:: strength :zeek:type:`int`

      How strongly the signature matched.  Used for
      prioritization when multiple file magic signatures
      match.


   .. zeek:field:: mime :zeek:type:`string`

      The MIME type of the file magic signature match.


   A structure indicating a MIME type and strength of a match against
   file magic signatures.

   :zeek:see:`file_magic`

.. zeek:type:: mime_matches
   :source-code: base/init-bare.zeek 156 156

   :Type: :zeek:type:`vector` of :zeek:type:`mime_match`

   A vector of file magic signature matches, ordered by strength of
   the signature, strongest first.

   :zeek:see:`file_magic`

.. zeek:type:: pcap_packet
   :source-code: base/init-bare.zeek 1622 1629

   :Type: :zeek:type:`record`


   .. zeek:field:: ts_sec :zeek:type:`count`

      The non-fractional part of the packet's timestamp (i.e., full seconds since the epoch).


   .. zeek:field:: ts_usec :zeek:type:`count`

      The fractional part of the packet's timestamp.


   .. zeek:field:: caplen :zeek:type:`count`

      The number of bytes captured (<= *len*).


   .. zeek:field:: len :zeek:type:`count`

      The length of the packet in bytes, including link-level header.


   .. zeek:field:: data :zeek:type:`string`

      The payload of the packet, including link-level header.


   .. zeek:field:: link_type :zeek:type:`link_encap`

      Layer 2 link encapsulation type.


   Policy-level representation of a packet passed on by libpcap. The data
   includes the complete packet as returned by libpcap, including the link-layer
   header.

   .. zeek:see:: dump_packet get_current_packet

.. zeek:type:: pkt_hdr
   :source-code: base/init-bare.zeek 2411 2417

   :Type: :zeek:type:`record`


   .. zeek:field:: ip :zeek:type:`ip4_hdr` :zeek:attr:`&optional`

      The IPv4 header if an IPv4 packet.


   .. zeek:field:: ip6 :zeek:type:`ip6_hdr` :zeek:attr:`&optional`

      The IPv6 header if an IPv6 packet.


   .. zeek:field:: tcp :zeek:type:`tcp_hdr` :zeek:attr:`&optional`

      The TCP header if a TCP packet.


   .. zeek:field:: udp :zeek:type:`udp_hdr` :zeek:attr:`&optional`

      The UDP header if a UDP packet.


   .. zeek:field:: icmp :zeek:type:`icmp_hdr` :zeek:attr:`&optional`

      The ICMP header if an ICMP packet.


   A packet header, consisting of an IP header and transport-layer header.

   .. zeek:see:: new_packet

.. zeek:type:: pkt_profile_modes
   :source-code: base/init-bare.zeek 2982 2988

   :Type: :zeek:type:`enum`

      .. zeek:enum:: PKT_PROFILE_MODE_NONE pkt_profile_modes

         No output.

      .. zeek:enum:: PKT_PROFILE_MODE_SECS pkt_profile_modes

         Output every :zeek:see:`pkt_profile_freq` seconds.

      .. zeek:enum:: PKT_PROFILE_MODE_PKTS pkt_profile_modes

         Output every :zeek:see:`pkt_profile_freq` packets.

      .. zeek:enum:: PKT_PROFILE_MODE_BYTES pkt_profile_modes

         Output every :zeek:see:`pkt_profile_freq` bytes.

   Output modes for packet profiling information.

   .. zeek:see:: pkt_profile_mode pkt_profile_freq pkt_profile_file

.. zeek:type:: plugin_component_vec
   :source-code: base/init-bare.zeek 426 426

   :Type: :zeek:type:`vector` of :zeek:type:`PluginComponent`


.. zeek:type:: pm_callit_request
   :source-code: base/init-bare.zeek 2927 2932

   :Type: :zeek:type:`record`


   .. zeek:field:: program :zeek:type:`count`

      The RPC program.


   .. zeek:field:: version :zeek:type:`count`

      The program version.


   .. zeek:field:: proc :zeek:type:`count`

      The procedure being called.


   .. zeek:field:: arg_size :zeek:type:`count`

      The size of the argument.


   An RPC portmapper *callit* request.

   .. zeek:see:: pm_attempt_callit pm_request_callit

.. zeek:type:: pm_mapping
   :source-code: base/init-bare.zeek 2904 2908

   :Type: :zeek:type:`record`


   .. zeek:field:: program :zeek:type:`count`

      The RPC program.


   .. zeek:field:: version :zeek:type:`count`

      The program version.


   .. zeek:field:: p :zeek:type:`port`

      The port.


   An RPC portmapper mapping.

   .. zeek:see:: pm_mappings

.. zeek:type:: pm_mappings
   :source-code: base/init-bare.zeek 2913 2913

   :Type: :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`pm_mapping`

   Table of RPC portmapper mappings.

   .. zeek:see:: pm_request_dump

.. zeek:type:: pm_port_request
   :source-code: base/init-bare.zeek 2918 2922

   :Type: :zeek:type:`record`


   .. zeek:field:: program :zeek:type:`count`

      The RPC program.


   .. zeek:field:: version :zeek:type:`count`

      The program version.


   .. zeek:field:: is_tcp :zeek:type:`bool`

      True if using TCP.


   An RPC portmapper request.

   .. zeek:see:: pm_attempt_getport pm_request_getport

.. zeek:type:: psk_identity_vec
   :source-code: base/init-bare.zeek 5317 5317

   :Type: :zeek:type:`vector` of :zeek:type:`SSL::PSKIdentity`


.. zeek:type:: raw_pkt_hdr
   :source-code: base/init-bare.zeek 2442 2449

   :Type: :zeek:type:`record`


   .. zeek:field:: l2 :zeek:type:`l2_hdr`

      The layer 2 header.


   .. zeek:field:: ip :zeek:type:`ip4_hdr` :zeek:attr:`&optional`

      The IPv4 header if an IPv4 packet.


   .. zeek:field:: ip6 :zeek:type:`ip6_hdr` :zeek:attr:`&optional`

      The IPv6 header if an IPv6 packet.


   .. zeek:field:: tcp :zeek:type:`tcp_hdr` :zeek:attr:`&optional`

      The TCP header if a TCP packet.


   .. zeek:field:: udp :zeek:type:`udp_hdr` :zeek:attr:`&optional`

      The UDP header if a UDP packet.


   .. zeek:field:: icmp :zeek:type:`icmp_hdr` :zeek:attr:`&optional`

      The ICMP header if an ICMP packet.


   A raw packet header, consisting of L2 header and everything in
   :zeek:see:`pkt_hdr`. .

   .. zeek:see:: raw_packet pkt_hdr

.. zeek:type:: record_field
   :source-code: base/init-bare.zeek 1416 1424

   :Type: :zeek:type:`record`


   .. zeek:field:: type_name :zeek:type:`string`

      The name of the field's type.


   .. zeek:field:: log :zeek:type:`bool`

      True if the field is declared with :zeek:attr:`&log` attribute.


   .. zeek:field:: value :zeek:type:`any` :zeek:attr:`&optional`

      The current value of the field in the record instance passed into
      :zeek:see:`record_fields` (if it has one).


   .. zeek:field:: default_val :zeek:type:`any` :zeek:attr:`&optional`

      The value of the :zeek:attr:`&default` attribute if defined.


   .. zeek:field:: optional :zeek:type:`bool`

      True if the field is :zeek:attr:`&optional`, else false.


   Meta-information about a record field.

   .. zeek:see:: record_fields record_field_table

.. zeek:type:: record_field_table
   :source-code: base/init-bare.zeek 1434 1434

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`record_field`

   Table type used to map record field declarations to meta-information
   describing them.

   .. zeek:see:: record_fields record_field

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: rotate_info
   :source-code: base/init-bare.zeek 1559 1564

   :Type: :zeek:type:`record`


   .. zeek:field:: old_name :zeek:type:`string`

      Original filename.


   .. zeek:field:: new_name :zeek:type:`string`

      File name after rotation.


   .. zeek:field:: open :zeek:type:`time`

      Time when opened.


   .. zeek:field:: close :zeek:type:`time`

      Time when closed.


   .. zeek:see:: rotate_file rotate_file_by_name

.. zeek:type:: script_id
   :source-code: base/init-bare.zeek 1391 1401

   :Type: :zeek:type:`record`


   .. zeek:field:: type_name :zeek:type:`string`

      The name of the identifier's type.


   .. zeek:field:: exported :zeek:type:`bool`

      True if the identifier is exported.


   .. zeek:field:: constant :zeek:type:`bool`

      True if the identifier is a constant.


   .. zeek:field:: enum_constant :zeek:type:`bool`

      True if the identifier is an enum value.


   .. zeek:field:: option_value :zeek:type:`bool`

      True if the identifier is an option.


   .. zeek:field:: redefinable :zeek:type:`bool`

      True if the identifier is declared with the :zeek:attr:`&redef` attribute.


   .. zeek:field:: broker_backend :zeek:type:`bool`

      True if the identifier has a Broker backend defined using the :zeek:attr:`&backend` attribute.


   .. zeek:field:: value :zeek:type:`any` :zeek:attr:`&optional`

      The current value of the identifier.


   .. zeek:field:: attributes :zeek:type:`script_id_attrs` :zeek:attr:`&optional`

      Attributes attached to this identifier, if any.


   Meta-information about a script-level identifier.

   .. zeek:see:: global_ids id_table

.. zeek:type:: script_id_attr
   :source-code: base/init-bare.zeek 1381 1384

   :Type: :zeek:type:`record`


   .. zeek:field:: name :zeek:type:`string`

      The name of the attribute including the &.


   .. zeek:field:: expr :zeek:type:`string` :zeek:attr:`&optional`

      The stringified expression, if any.


   Meta-information about script-level attribute.

.. zeek:type:: script_id_attrs
   :source-code: base/init-bare.zeek 1386 1386

   :Type: :zeek:type:`vector` of :zeek:type:`script_id_attr`


.. zeek:type:: signature_and_hashalgorithm_vec
   :source-code: base/init-bare.zeek 5315 5315

   :Type: :zeek:type:`vector` of :zeek:type:`SSL::SignatureAndHashAlgorithm`

   A vector of Signature and Hash Algorithms.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: signature_state
   :source-code: base/init-bare.zeek 3383 3388

   :Type: :zeek:type:`record`


   .. zeek:field:: sig_id :zeek:type:`string`

      ID of the matching signature.


   .. zeek:field:: conn :zeek:type:`connection`

      Matching connection.


   .. zeek:field:: is_orig :zeek:type:`bool`

      True if matching endpoint is originator.


   .. zeek:field:: payload_size :zeek:type:`count`

      Payload size of the first matching packet of current endpoint.


   Description of a signature match.

   .. zeek:see:: signature_match

.. zeek:type:: string_any_file_hook
   :source-code: base/init-bare.zeek 1089 1089

   :Type: :zeek:type:`hook` (f: :zeek:type:`fa_file`, e: :zeek:type:`any`, str: :zeek:type:`string`) : :zeek:type:`bool`

   A hook taking a fa_file, an any, and a string. Used by the X509 analyzer as callback.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: string_any_table
   :source-code: base/init-bare.zeek 19 19

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`any`

   A string-table of any.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: string_array
   :source-code: base/init-bare.zeek 12 12

   :Type: :zeek:type:`table` [:zeek:type:`count`] of :zeek:type:`string`

   An ordered array of strings. The entries are indexed by successive numbers.
   Note that it depends on the usage whether the first index is zero or one.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: string_mapper
   :source-code: base/init-bare.zeek 139 139

   :Type: :zeek:type:`function` (s: :zeek:type:`string`) : :zeek:type:`string`

   Function mapping a string to a string.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: string_set
   :source-code: base/init-bare.zeek 26 26

   :Type: :zeek:type:`set` [:zeek:type:`string`]

   A set of strings.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: string_vec
   :source-code: base/init-bare.zeek 90 90

   :Type: :zeek:type:`vector` of :zeek:type:`string`

   A vector of strings.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: subnet_set
   :source-code: base/init-bare.zeek 33 33

   :Type: :zeek:type:`set` [:zeek:type:`subnet`]

   A set of subnets.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: subnet_vec
   :source-code: base/init-bare.zeek 75 75

   :Type: :zeek:type:`vector` of :zeek:type:`subnet`

   A vector of subnets.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: sw_align
   :source-code: base/init-bare.zeek 1588 1591

   :Type: :zeek:type:`record`


   .. zeek:field:: str :zeek:type:`string`

      String a substring is part of.


   .. zeek:field:: index :zeek:type:`count`

      Offset substring is located.


   Helper type for return value of Smith-Waterman algorithm.

   .. zeek:see:: str_smith_waterman sw_substring_vec sw_substring sw_align_vec sw_params

.. zeek:type:: sw_align_vec
   :source-code: base/init-bare.zeek 1596 1596

   :Type: :zeek:type:`vector` of :zeek:type:`sw_align`

   Helper type for return value of Smith-Waterman algorithm.

   .. zeek:see:: str_smith_waterman sw_substring_vec sw_substring sw_align sw_params

.. zeek:type:: sw_params
   :source-code: base/init-bare.zeek 1577 1583

   :Type: :zeek:type:`record`


   .. zeek:field:: min_strlen :zeek:type:`count` :zeek:attr:`&default` = ``3`` :zeek:attr:`&optional`

      Minimum size of a substring, minimum "granularity".


   .. zeek:field:: sw_variant :zeek:type:`count` :zeek:attr:`&default` = ``0`` :zeek:attr:`&optional`

      Smith-Waterman flavor to use.


   Parameters for the Smith-Waterman algorithm.

   .. zeek:see:: str_smith_waterman

.. zeek:type:: sw_substring
   :source-code: base/init-bare.zeek 1602 1606

   :Type: :zeek:type:`record`


   .. zeek:field:: str :zeek:type:`string`

      A substring.


   .. zeek:field:: aligns :zeek:type:`sw_align_vec`

      All strings of which it's a substring.


   .. zeek:field:: new :zeek:type:`bool`

      True if start of new alignment.


   Helper type for return value of Smith-Waterman algorithm.

   .. zeek:see:: str_smith_waterman sw_substring_vec sw_align_vec sw_align sw_params


.. zeek:type:: sw_substring_vec
   :source-code: base/init-bare.zeek 1615 1615

   :Type: :zeek:type:`vector` of :zeek:type:`sw_substring`

   Return type for Smith-Waterman algorithm.

   .. zeek:see:: str_smith_waterman sw_substring sw_align_vec sw_align sw_params

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: table_string_of_count
   :source-code: base/init-bare.zeek 118 118

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`count`

   A table of counts indexed by strings.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: table_string_of_string
   :source-code: base/init-bare.zeek 111 111

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`string`

   A table of strings indexed by strings.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: tcp_hdr
   :source-code: base/init-bare.zeek 2380 2390

   :Type: :zeek:type:`record`


   .. zeek:field:: sport :zeek:type:`port`

      source port.


   .. zeek:field:: dport :zeek:type:`port`

      destination port


   .. zeek:field:: seq :zeek:type:`count`

      sequence number


   .. zeek:field:: ack :zeek:type:`count`

      acknowledgement number


   .. zeek:field:: hl :zeek:type:`count`

      header length (in bytes)


   .. zeek:field:: dl :zeek:type:`count`

      data length (xxx: not in original tcphdr!)


   .. zeek:field:: reserved :zeek:type:`count`

      The "reserved" 4 bits after the "data offset" field.


   .. zeek:field:: flags :zeek:type:`count`

      The 8 bits of flags after the "reserved" field.


   .. zeek:field:: win :zeek:type:`count`

      window


   Values extracted from a TCP header.

   .. zeek:see:: pkt_hdr discarder_check_tcp

.. zeek:type:: teredo_auth
   :source-code: base/init-bare.zeek 2456 2464

   :Type: :zeek:type:`record`


   .. zeek:field:: id :zeek:type:`string`

      Teredo client identifier.


   .. zeek:field:: value :zeek:type:`string`

      HMAC-SHA1 over shared secret key between client and
      server, nonce, confirmation byte, origin indication
      (if present), and the IPv6 packet.


   .. zeek:field:: nonce :zeek:type:`count`

      Nonce chosen by Teredo client to be repeated by
      Teredo server.


   .. zeek:field:: confirm :zeek:type:`count`

      Confirmation byte to be set to 0 by Teredo client
      and non-zero by server if client needs new key.


   A Teredo origin indication header.  See :rfc:`4380` for more information
   about the Teredo protocol.

   .. zeek:see:: teredo_bubble teredo_origin_indication teredo_authentication
      teredo_hdr

.. zeek:type:: teredo_hdr
   :source-code: base/init-bare.zeek 2481 2485

   :Type: :zeek:type:`record`


   .. zeek:field:: auth :zeek:type:`teredo_auth` :zeek:attr:`&optional`

      Teredo authentication header.


   .. zeek:field:: origin :zeek:type:`teredo_origin` :zeek:attr:`&optional`

      Teredo origin indication header.


   .. zeek:field:: hdr :zeek:type:`pkt_hdr`

      IPv6 and transport protocol headers.


   A Teredo packet header.  See :rfc:`4380` for more information about the
   Teredo protocol.

   .. zeek:see:: teredo_bubble teredo_origin_indication teredo_authentication

.. zeek:type:: teredo_origin
   :source-code: base/init-bare.zeek 2472 2475

   :Type: :zeek:type:`record`


   .. zeek:field:: p :zeek:type:`port`

      Unobfuscated UDP port of Teredo client.


   .. zeek:field:: a :zeek:type:`addr`

      Unobfuscated IPv4 address of Teredo client.


   A Teredo authentication header.  See :rfc:`4380` for more information
   about the Teredo protocol.

   .. zeek:see:: teredo_bubble teredo_origin_indication teredo_authentication
      teredo_hdr

.. zeek:type:: transport_proto
   :source-code: base/init-bare.zeek 199 205

   :Type: :zeek:type:`enum`

      .. zeek:enum:: unknown_transport transport_proto

         An unknown transport-layer protocol.

      .. zeek:enum:: tcp transport_proto

         TCP.

      .. zeek:enum:: udp transport_proto

         UDP.

      .. zeek:enum:: icmp transport_proto

         ICMP.

   A connection's transport-layer protocol. Note that Zeek uses the term
   "connection" broadly, using flow semantics for ICMP and UDP.

.. zeek:type:: udp_hdr
   :source-code: base/init-bare.zeek 2395 2399

   :Type: :zeek:type:`record`


   .. zeek:field:: sport :zeek:type:`port`

      source port


   .. zeek:field:: dport :zeek:type:`port`

      destination port


   .. zeek:field:: ulen :zeek:type:`count`

      udp length


   Values extracted from a UDP header.

   .. zeek:see:: pkt_hdr discarder_check_udp

.. zeek:type:: var_sizes
   :source-code: base/init-bare.zeek 1378 1378

   :Type: :zeek:type:`table` [:zeek:type:`string`] of :zeek:type:`count`

   Table type used to map variable names to their memory allocation.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: x509_opaque_vector
   :source-code: base/init-bare.zeek 97 97

   :Type: :zeek:type:`vector` of :zeek:type:`opaque` of x509

   A vector of x509 opaques.

   .. todo:: We need this type definition only for declaring builtin functions
      via ``bifcl``. We should extend ``bifcl`` to understand composite types
      directly and then remove this alias.

.. zeek:type:: ConnKey::Tag

   :Type: :zeek:type:`enum`

      .. zeek:enum:: ConnKey::CONNKEY_FIVETUPLE ConnKey::Tag

      .. zeek:enum:: ConnKey::CONNKEY_VLAN_FIVETUPLE ConnKey::Tag

      .. zeek:enum:: ConnKey::CONNKEY_PACKETSOURCE_UDP_GENEVE_VNI_FIVETUPLE ConnKey::Tag

      .. zeek:enum:: ConnKey::CONNKEY_PACKETSOURCE_UDP_GENEVE_VXLAN_VNI_FIVETUPLE ConnKey::Tag

      .. zeek:enum:: ConnKey::CONNKEY_PACKETSOURCE_UDP_VXLAN_VNI_FIVETUPLE ConnKey::Tag


Events
######
.. zeek:id:: Cluster::forward_table_change_infos
   :source-code: base/frameworks/cluster/publish-on-change.zeek 81 100

   :Type: :zeek:type:`event` (tcheader: :zeek:type:`Cluster::TableChangeHeader`, tcinfos: :zeek:type:`Cluster::TableChangeInfos`, to_topic: :zeek:type:`string`)

   Internal helper event used by worker processes to delegate publishing
   to the Zeek manager when running under Broker.

   If ``to`` is manager_topic or starts with /zeek/table/, the manager
   will also raise table_change_infos() locally for itself.


   :param tcheader: Header with common information.

   :param tcinfos: Accumulated changes as a vector.

   :param to_topic: The topic to publish the table_change_infos() event to.

.. zeek:id:: Cluster::table_change_infos
   :source-code: base/frameworks/cluster/publish-on-change.zeek 39 59

   :Type: :zeek:type:`event` (tcheader: :zeek:type:`Cluster::TableChangeHeader`, tcinfos: :zeek:type:`Cluster::TableChangeInfos`)

   Internal'ish event for propagating table changes via :zeek:see:`Cluster::publish`
   to other Zeek processes in a cluster.


   :param tcheader: Header with common information.

   :param tcinfos: Accumulated changes as a vector.

Hooks
#####
.. zeek:id:: Cluster::apply_table_change_infos_policy
   :source-code: base/init-bare.zeek 6405 6405

   :Type: :zeek:type:`hook` (tcheader: :zeek:type:`Cluster::TableChangeHeader`, tcinfos: :zeek:type:`Cluster::TableChangeInfos`) : :zeek:type:`bool`

   A hook for testing and intercepting changes to tables coming in
   via the &publish_on_change mechanism from other Zeek processes.

   Breaking from this hook discards the changes. I.e. they'll not
   be applied to the table or set identified by id.


   :param id: Script-level identifier of the table or set.

   :param ts: Network timestamp at the time of sending.

   :param table_change_infos: vector of changes as batched by the remote Zeek process.

.. zeek:id:: Telemetry::sync
   :source-code: base/init-bare.zeek 6606 6606

   :Type: :zeek:type:`hook` () : :zeek:type:`bool`

   Telemetry sync hook.

   This hook is invoked when metrics are requested via functions
   :zeek:see:`Telemetry::collect_metrics` and :zeek:see:`Telemetry::collect_histogram_metrics`,
   or just before Zeek collects metrics when being scraped through
   its Prometheus endpoint.
   Script writers can use it to synchronize (or mirror) metrics with the
   telemetry subsystem. For example, when tracking table or value
   footprints with gauges, the value in question can be set on an actual
   :zeek:see:`Telemetry::Gauge` instance during execution of this hook.

   Implementations should be lightweight, this hook may be called
   multiple times per minute.

Functions
#########
.. zeek:id:: add_interface
   :source-code: base/init-bare.zeek 2679 2685

   :Type: :zeek:type:`function` (iold: :zeek:type:`string`, inew: :zeek:type:`string`) : :zeek:type:`string`

   Internal function.

.. zeek:id:: add_signature_file
   :source-code: base/init-bare.zeek 2692 2698

   :Type: :zeek:type:`function` (sold: :zeek:type:`string`, snew: :zeek:type:`string`) : :zeek:type:`string`

   Internal function.

.. zeek:id:: discarder_check_icmp
   :source-code: base/init-bare.zeek 2784 2784

   :Type: :zeek:type:`function` (p: :zeek:type:`pkt_hdr`) : :zeek:type:`bool`

   Function for skipping packets based on their ICMP header. If defined, this
   function will be called for all ICMP packets before Zeek performs any further
   analysis. If the function signals to discard a packet, no further processing
   will be performed on it.


   :param p: The IP and ICMP headers of the considered packet.


   :returns: True if the packet should not be analyzed any further.

   .. zeek:see:: discarder_check_ip discarder_check_tcp discarder_check_udp
      discarder_maxlen

   .. note:: This is very low-level functionality and potentially expensive.
      Avoid using it.

.. zeek:id:: discarder_check_ip
   :source-code: base/init-bare.zeek 2732 2732

   :Type: :zeek:type:`function` (p: :zeek:type:`pkt_hdr`) : :zeek:type:`bool`

   Function for skipping packets based on their IP header. If defined, this
   function will be called for all IP packets before Zeek performs any further
   analysis. If the function signals to discard a packet, no further processing
   will be performed on it.


   :param p: The IP header of the considered packet.


   :returns: True if the packet should not be analyzed any further.

   .. zeek:see:: discarder_check_tcp discarder_check_udp discarder_check_icmp
      discarder_maxlen

   .. note:: This is very low-level functionality and potentially expensive.
      Avoid using it.

.. zeek:id:: discarder_check_tcp
   :source-code: base/init-bare.zeek 2750 2750

   :Type: :zeek:type:`function` (p: :zeek:type:`pkt_hdr`, d: :zeek:type:`string`) : :zeek:type:`bool`

   Function for skipping packets based on their TCP header. If defined, this
   function will be called for all TCP packets before Zeek performs any further
   analysis. If the function signals to discard a packet, no further processing
   will be performed on it.


   :param p: The IP and TCP headers of the considered packet.


   :param d: Up to :zeek:see:`discarder_maxlen` bytes of the TCP payload.


   :returns: True if the packet should not be analyzed any further.

   .. zeek:see:: discarder_check_ip discarder_check_udp discarder_check_icmp
      discarder_maxlen

   .. note:: This is very low-level functionality and potentially expensive.
      Avoid using it.

.. zeek:id:: discarder_check_udp
   :source-code: base/init-bare.zeek 2768 2768

   :Type: :zeek:type:`function` (p: :zeek:type:`pkt_hdr`, d: :zeek:type:`string`) : :zeek:type:`bool`

   Function for skipping packets based on their UDP header. If defined, this
   function will be called for all UDP packets before Zeek performs any further
   analysis. If the function signals to discard a packet, no further processing
   will be performed on it.


   :param p: The IP and UDP headers of the considered packet.


   :param d: Up to :zeek:see:`discarder_maxlen` bytes of the UDP payload.


   :returns: True if the packet should not be analyzed any further.

   .. zeek:see:: discarder_check_ip discarder_check_tcp discarder_check_icmp
      discarder_maxlen

   .. note:: This is very low-level functionality and potentially expensive.
      Avoid using it.

.. zeek:id:: from_json_default_key_mapper
   :source-code: base/init-bare.zeek 1692 1695

   :Type: :zeek:type:`function` (s: :zeek:type:`string`) : :zeek:type:`string`

   The default JSON key mapper function. Identity function.

.. zeek:id:: max_count
   :source-code: base/init-bare.zeek 2854 2855

   :Type: :zeek:type:`function` (a: :zeek:type:`count`, b: :zeek:type:`count`) : :zeek:type:`count`

   Returns maximum of two ``count`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The maximum of *a* and *b*.

.. zeek:id:: max_double
   :source-code: base/init-bare.zeek 2822 2823

   :Type: :zeek:type:`function` (a: :zeek:type:`double`, b: :zeek:type:`double`) : :zeek:type:`double`

   Returns maximum of two ``double`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The maximum of *a* and *b*.

.. zeek:id:: max_interval
   :source-code: base/init-bare.zeek 2838 2839

   :Type: :zeek:type:`function` (a: :zeek:type:`interval`, b: :zeek:type:`interval`) : :zeek:type:`interval`

   Returns maximum of two ``interval`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The maximum of *a* and *b*.

.. zeek:id:: min_count
   :source-code: base/init-bare.zeek 2846 2847

   :Type: :zeek:type:`function` (a: :zeek:type:`count`, b: :zeek:type:`count`) : :zeek:type:`count`

   Returns minimum of two ``count`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The minimum of *a* and *b*.

.. zeek:id:: min_double
   :source-code: base/init-bare.zeek 2814 2815

   :Type: :zeek:type:`function` (a: :zeek:type:`double`, b: :zeek:type:`double`) : :zeek:type:`double`

   Returns minimum of two ``double`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The minimum of *a* and *b*.

.. zeek:id:: min_interval
   :source-code: base/init-bare.zeek 2830 2831

   :Type: :zeek:type:`function` (a: :zeek:type:`interval`, b: :zeek:type:`interval`) : :zeek:type:`interval`

   Returns minimum of two ``interval`` values.


   :param a: First value.

   :param b: Second value.


   :returns: The minimum of *a* and *b*.


