Fixing duplicate SSH authentication failure events.

We now do not raise more than one failure event per connection.

Addresses BIT-1641.
This commit is contained in:
Robin Sommer 2016-08-01 08:42:36 -07:00
parent 420bef58aa
commit 176d9f23be
4 changed files with 31 additions and 7 deletions

View file

@ -0,0 +1,7 @@
# @TEST-EXEC: bro -C -r $TRACES/ssh/sshguess.pcap %INPUT | sort | uniq -c >output
# @TEST-EXEC: btest-diff output
event ssh_auth_failed(c: connection)
{
print c$uid;
}