Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add conn.log entries for connections with unhandled IP protocols

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-09-10 15:13:11 +02:00
parent a96515a2e8
commit 35ec9733c0
422 changed files with 97715 additions and 97282 deletions
Download patch file Download diff file Expand all files Collapse all files

44
testing/btest/Baseline/scripts.base.protocols.ssh.half-duplex-server/conn.log
View file

@ -5,26 +5,26 @@
#unset_field -
#path conn
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 tcp - 6.013825 0 2501 SHR T F 0 ^hdaf 0 0 20 3549 -
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.2.1 57189 192.168.2.158 22 tcp - 6.641675 0 3489 SHR T T 0 ^hadf 0 0 29 5005 -
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57191 192.168.2.158 22 tcp - 3.862105 0 813 SHR T T 0 ^hdaf 0 0 16 1653 -
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 56594 192.168.2.158 22 tcp - 8.841592 0 537 SHR T T 0 ^hdaf 0 0 14 1273 -
XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 56821 192.168.2.158 22 tcp - 1.106164 0 1125 SHR T T 0 ^hdaf 0 0 20 2173 -
XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.1 56837 192.168.2.158 22 tcp - 1.080689 0 997 SHR T T 0 ^hdaf 0 0 19 1993 -
XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.2.1 56845 192.168.2.158 22 tcp - 1.302374 0 965 SHR T T 0 ^hdaf 0 0 20 2013 -
XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.1 56875 192.168.2.158 22 tcp - 12.013362 0 549 SHR T T 0 ^hdaf 0 0 16 1389 -
XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.1 56878 192.168.2.158 22 tcp - 3.628800 0 825 SHR T T 0 ^hdaf 0 0 19 1821 -
XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.1 56940 192.168.2.158 22 tcp - 0.104755 0 609 SHR T T 0 ^hdaf 0 0 10 1137 -
XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 57831 192.168.2.158 22 tcp - 2.758679 0 813 SHR T T 0 ^hdaf 0 0 18 1757 -
XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 59246 192.168.2.158 22 tcp - 3.076531 0 4165 SHR T T 0 ^hadf 0 0 23 5369 -
XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.1.32 41164 128.2.10.238 22 tcp - 8.458002 0 3015 SHR T F 0 ^hadf 0 0 33 4763 -
XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.1.32 33910 128.2.13.133 22 tcp - 1.883790 0 6037 SHR T F 0 ^hadf 0 0 29 7565 -
XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41268 128.2.10.238 22 tcp - 2.684423 0 2487 SHR T F 0 ^hadf 0 0 20 3535 -
XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.31 52294 192.168.1.32 22 tcp - 3.659871 0 2229 SHR T T 0 ^hadf 0 0 24 3497 -
XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.31 51489 192.168.1.32 22 tcp - 4.927268 0 2497 SHR T T 0 ^hdaf 0 0 27 3937 -
XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.1.32 58641 131.103.20.168 22 tcp - 0.542658 0 2309 SHR T F 0 ^hdaf 0 0 13 2993 -
XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.1.32 58646 131.103.20.168 22 tcp - 2.198678 0 535101 SHR T F 0 ^hadf 0 0 226 546861 -
XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.1.32 58649 131.103.20.168 22 tcp - 2.026830 0 534861 SHR T F 0 ^hadf 0 0 236 547141 -
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents protocol_id
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] count
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 tcp - 6.013825 0 2501 SHR T F 0 ^hdaf 0 0 20 3549 - 6
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.2.1 57189 192.168.2.158 22 tcp - 6.641675 0 3489 SHR T T 0 ^hadf 0 0 29 5005 - 6
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57191 192.168.2.158 22 tcp - 3.862105 0 813 SHR T T 0 ^hdaf 0 0 16 1653 - 6
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 56594 192.168.2.158 22 tcp - 8.841592 0 537 SHR T T 0 ^hdaf 0 0 14 1273 - 6
XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 56821 192.168.2.158 22 tcp - 1.106164 0 1125 SHR T T 0 ^hdaf 0 0 20 2173 - 6
XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.1 56837 192.168.2.158 22 tcp - 1.080689 0 997 SHR T T 0 ^hdaf 0 0 19 1993 - 6
XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.2.1 56845 192.168.2.158 22 tcp - 1.302374 0 965 SHR T T 0 ^hdaf 0 0 20 2013 - 6
XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.1 56875 192.168.2.158 22 tcp - 12.013362 0 549 SHR T T 0 ^hdaf 0 0 16 1389 - 6
XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.1 56878 192.168.2.158 22 tcp - 3.628800 0 825 SHR T T 0 ^hdaf 0 0 19 1821 - 6
XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.1 56940 192.168.2.158 22 tcp - 0.104755 0 609 SHR T T 0 ^hdaf 0 0 10 1137 - 6
XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 57831 192.168.2.158 22 tcp - 2.758679 0 813 SHR T T 0 ^hdaf 0 0 18 1757 - 6
XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 59246 192.168.2.158 22 tcp - 3.076531 0 4165 SHR T T 0 ^hadf 0 0 23 5369 - 6
XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.1.32 41164 128.2.10.238 22 tcp - 8.458002 0 3015 SHR T F 0 ^hadf 0 0 33 4763 - 6
XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.1.32 33910 128.2.13.133 22 tcp - 1.883790 0 6037 SHR T F 0 ^hadf 0 0 29 7565 - 6
XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41268 128.2.10.238 22 tcp - 2.684423 0 2487 SHR T F 0 ^hadf 0 0 20 3535 - 6
XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.31 52294 192.168.1.32 22 tcp - 3.659871 0 2229 SHR T T 0 ^hadf 0 0 24 3497 - 6
XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.31 51489 192.168.1.32 22 tcp - 4.927268 0 2497 SHR T T 0 ^hdaf 0 0 27 3937 - 6
XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.1.32 58641 131.103.20.168 22 tcp - 0.542658 0 2309 SHR T F 0 ^hdaf 0 0 13 2993 - 6
XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.1.32 58646 131.103.20.168 22 tcp - 2.198678 0 535101 SHR T F 0 ^hadf 0 0 226 546861 - 6
XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.1.32 58649 131.103.20.168 22 tcp - 2.026830 0 534861 SHR T F 0 ^hadf 0 0 236 547141 - 6
#close XXXX-XX-XX-XX-XX-XX