diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-secondary-request/.stdout b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-secondary-request/.stdout new file mode 100644 index 0000000000..10cad0c702 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction-secondary-request/.stdout @@ -0,0 +1 @@ +smb1_transaction_secondary_request hdr: [command=38, status=0, flags=0, flags2=0, tid=45374, pid=1, uid=57674, mid=2], args: [total_param_count=11, total_data_count=9, param_count=11, param_offset=52, param_displacement=9, data_count=9, data_offset=66, data_displacement=11], params: some_params, data: some_data diff --git a/testing/btest/Traces/smb/smb1_transaction_secondary_request.pcap b/testing/btest/Traces/smb/smb1_transaction_secondary_request.pcap new file mode 100644 index 0000000000..4236b140d5 Binary files /dev/null and b/testing/btest/Traces/smb/smb1_transaction_secondary_request.pcap differ diff --git a/testing/btest/scripts/base/protocols/smb/smb1-transaction-secondary-request.test b/testing/btest/scripts/base/protocols/smb/smb1-transaction-secondary-request.test new file mode 100644 index 0000000000..03bddf7bf5 --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb1-transaction-secondary-request.test @@ -0,0 +1,12 @@ +#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction_secondary_request.pcap %INPUT +#@TEST-EXEC: btest-diff .stdout + +@load base/protocols/smb +@load policy/protocols/smb + +# Check that smb1_transaction_secondary requests are parsed correctly + +event smb1_transaction_secondary_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans_Sec_Args, parameters: string, data: string) +{ + print fmt("smb1_transaction_secondary_request hdr: %s, args: %s, params: %s, data: %s", hdr, args, parameters, data); +}