zeek.py: make it clear that tx_hosts is the server in files.log

stratosphereips · Oct 24, 2024 · d22cded · d22cded
1 parent 6b801d7
commit d22cded
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/slips_files/core/input_profilers/zeek.py b/slips_files/core/input_profilers/zeek.py
@@ -213,8 +213,12 @@ def process_line(self, new_line: dict):
                 line.get("source", ""),
                 line.get("analyzers", ""),
                 line.get("sha1", ""),
-                line.get("tx_hosts", ""),
-                line.get("rx_hosts", ""),
+                line.get(
+                    "tx_hosts", ""
+                ),  # this srcip is tx_hosts in the zeek files.log, aka sender of the
+                # file, aka server
+                line.get("rx_hosts", ""),  # this is the host that received
+                # the file
             )
         elif "arp" in file_type:
             self.flow: ARP = ARP(