mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
Add script to detect filtered TCP traces, addresses BIT-1119.
If reading a trace file w/ only TCP control packets, a warning is emitted to suggest the 'detect_filtered_traces' option if the user doesn't desire Bro to report missing TCP segments for such a trace file.
This commit is contained in:
parent
c671491149
commit
0cb2a90da4
7 changed files with 58 additions and 2 deletions
|
@ -3,7 +3,7 @@
|
|||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path loaded_scripts
|
||||
#open 2013-10-30-16-52-28
|
||||
#open 2014-01-31-22-54-38
|
||||
#fields name
|
||||
#types string
|
||||
scripts/base/init-bare.bro
|
||||
|
@ -220,5 +220,6 @@ scripts/base/init-default.bro
|
|||
scripts/base/files/unified2/__load__.bro
|
||||
scripts/base/files/unified2/main.bro
|
||||
scripts/base/misc/find-checksum-offloading.bro
|
||||
scripts/base/misc/find-filtered-trace.bro
|
||||
scripts/policy/misc/loaded-scripts.bro
|
||||
#close 2013-10-30-16-52-28
|
||||
#close 2014-01-31-22-54-38
|
||||
|
|
|
@ -0,0 +1 @@
|
|||
1389719059.311687 warning in /Users/jsiwek/Projects/bro/bro/scripts/base/misc/find-filtered-trace.bro, line 48: The analyzed trace file was determined to contain only TCP control packets, which may indicate it's been pre-filtered. By default, Bro reports the missing segments for this type of trace, but the 'detect_filtered_trace' option may be toggled if that's not desired.
|
BIN
testing/btest/Traces/http/bro.org-filtered.pcap
Normal file
BIN
testing/btest/Traces/http/bro.org-filtered.pcap
Normal file
Binary file not shown.
4
testing/btest/scripts/base/misc/find-filtered-trace.test
Normal file
4
testing/btest/scripts/base/misc/find-filtered-trace.test
Normal file
|
@ -0,0 +1,4 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/bro.org-filtered.pcap >out1 2>&1
|
||||
# @TEST-EXEC: bro -r $TRACES/http/bro.org-filtered.pcap "FilteredTraceDetection::enable=F" >out2 2>&1
|
||||
# @TEST-EXEC: TEST_DIFF_CANOIFIER=$SCRIPTS/diff-remove-abspath btest-diff out1
|
||||
# @TEST-EXEC: btest-diff out2
|
Loading…
Add table
Add a link
Reference in a new issue