json/flow: log if flow had gap in TCP

4 years ago · 06b6f85c1f
parent f9faff5c4c
commit 06b6f85c1f
1 changed files with 6 additions and 0 deletions
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@ -309,6 +309,12 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
            const char *tcp_state = StreamTcpStateAsString(ssn->state);
            if (tcp_state != NULL)
                jb_set_string(jb, "state", tcp_state);
+            if (FlowHasGaps(f, STREAM_TOCLIENT)) {
+                JB_SET_TRUE(jb, "tc_gap");
+            }
+            if (FlowHasGaps(f, STREAM_TOSERVER)) {
+                JB_SET_TRUE(jb, "ts_gap");
+            }
        }

        /* Close tcp. */