Zeek conn with DSCP flags?

[TotieBash]

I use Zeek conn log like for network flow record. I need it to include DSCP flags in the Zeek conn log. How can I tweak the Zeek conn script to add DSCP flags to the metadata it ingest?

[J-Gras]

DSCP flags are encoded in the IP header's TOS field, correct? If so, theoretically each packet of a connection could have a different value. How do you want to deal with this?

[vpax]

While that's true, for the most part they won't change on a flow, as they're meant to provide per-flow QOS (of a sort)

[J-Gras]

In that case I would probably look at current_packet_header() in connection_established. Something along the lines of:

redef record connection += { tos: count &optional; };
redef record Conn::Info += { tos: count &optional &log; };

event connection_established(c: connection)
  {
  local hdr = get_current_packet_header();
  if ( hdr?$ip )
    c$tos = hdr$ip$tos;
  }
	
event connection_state_remove(c: connection)
  {
  if ( c?$tos )
    c$conn$tos = c$tos;
  }

However, be aware of the caveats described for get_current_packet[_header]: https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-get_current_packet

[TotieBash]

@J-Gras so sorry, treat me as new and dumb, it will be my first time tweaking a zeek script. Which file do I need to look at?

[J-Gras]

The preferred way would be to put that in a custom script. Depending on how you invoke Zeek, you can pass the file via command line or add a @load to your local.zeek. See https://docs.zeek.org/en/master/quickstart.html