diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout new file mode 100644 index 0000000000..a31a286d1f --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-transaction2-request/.stdout @@ -0,0 +1 @@ +smb1_transaction2_request hdr: [command=50, status=0, flags=0, flags2=0, tid=47242, pid=1, uid=2017, mid=2], args: [total_param_count=13, total_data_count=0, max_param_count=0, max_data_count=0, max_setup_count=0, flags=0, trans_timeout=0, param_count=13, param_offset=69, data_count=0, data_offset=0, setup_count=1], sub_cmd: 5 diff --git a/testing/btest/Traces/smb/smb1_transaction2_request.pcap b/testing/btest/Traces/smb/smb1_transaction2_request.pcap new file mode 100644 index 0000000000..564579597e Binary files /dev/null and b/testing/btest/Traces/smb/smb1_transaction2_request.pcap differ diff --git a/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test b/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test new file mode 100644 index 0000000000..9cd7c996f7 --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb1-transaction2-request.test @@ -0,0 +1,12 @@ +#@TEST-EXEC: bro -b -C -r $TRACES/smb/smb1_transaction2_request.pcap %INPUT +#@TEST-EXEC: btest-diff .stdout + +@load base/protocols/smb +@load policy/protocols/smb + +# Check that smb1_transaction2 requests are parsed correctly + +event smb1_transaction2_request(c: connection, hdr: SMB1::Header, args: SMB1::Trans2_Args, sub_cmd: count) +{ + print fmt("smb1_transaction2_request hdr: %s, args: %s, sub_cmd: %x", hdr, args, sub_cmd); +}