Merge remote-tracking branch 'origin/topic/jsiwek/tcp-improvements'

* origin/topic/jsiwek/tcp-improvements:
  Add script to detect filtered TCP traces, addresses BIT-1119.

BIT-1119 #merged

If we could only disable an event handler dynamically ...

testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log

@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-10-30-16-52-28
+#open	2014-01-31-22-54-38
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -220,5 +220,6 @@ scripts/base/init-default.bro
   scripts/base/files/unified2/__load__.bro
     scripts/base/files/unified2/main.bro
   scripts/base/misc/find-checksum-offloading.bro
+  scripts/base/misc/find-filtered-trace.bro
 scripts/policy/misc/loaded-scripts.bro
-#close	2013-10-30-16-52-28
+#close	2014-01-31-22-54-38

testing/btest/Baseline/scripts.base.misc.find-filtered-trace/out1

@@ -0,0 +1 @@
+1389719059.311687 warning in /Users/jsiwek/Projects/bro/bro/scripts/base/misc/find-filtered-trace.bro, line 48: The analyzed trace file was determined to contain only TCP control packets, which may indicate it's been pre-filtered.  By default, Bro reports the missing segments for this type of trace, but the 'detect_filtered_trace' option may be toggled if that's not desired.

testing/btest/scripts/base/misc/find-filtered-trace.test

@@ -0,0 +1,4 @@
+# @TEST-EXEC: bro -r $TRACES/http/bro.org-filtered.pcap >out1 2>&1
+# @TEST-EXEC: bro -r $TRACES/http/bro.org-filtered.pcap "FilteredTraceDetection::enable=F" >out2 2>&1
+# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out1
+# @TEST-EXEC: btest-diff out2