Ooops!
I found a bug yesterday and a new fixed released is available:
<
https://www.cert.se/megatron/megatron-pub-1.0.12.tar.gz>
<
https://github.com/cert-se/megatron-java/releases>
The tarball for the old release (1.0.11) is nuked.
Description of the bug: When decorator.asnGeoIpDecorator.useAsnInLogEntry=false
ASN is stored in LogEntry.additionalItem and not in LogEntry.asn. When matching a
LogEntry against organizations only LogEntry.asn was checked. The class
OrganizationMatcherDecorator have been updated to check both LogEntry.asn *and*
ASN in LogEntry.additionalItem.
The bug is present in all versions prior v1.0.12. The property useAsnInLogEntry is
true by default, but overridden in the following configs/job-types:
* ip-flowing.properties
* ip-flowing-fast.properties
* ip-flowing-verbose.properties
The bug is only triggered when useAsnInLogEntry=false.
/Tor